CVE-2026-74866

Name of the Vulnerable Software and Affected Versions @fastify/busboy versions prior to 3.2.2

Description This multipart form-data parser for Node.js fails to correctly handle lone carriage return or line feed characters in part headers, as it only splits lines on the two-byte carriage-return line-feed sequence. Consequently, these characters are passed verbatim into the parsed Content-Disposition filename and field name. An attacker can exploit this by uploading files with filenames or field names containing these characters to inject control characters into applications that trust the parser. This can lead to filesystem filename pollution, log forging, or header injection when the values are sent to a carriage-return-sensitive sink.

Recommendations Upgrade to version 3.2.2. For consumers such as @fastify/multipart, update the @fastify/busboy dependency to version 3.2.2.