CVE-2025-24033 @fastify/multipart vulnerable to unlimited consumption of resources
Attackers can cause resource exhaustion by canceling requests, leaving temporary files undeleted in the Fastify multipart plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24033?
CVE-2025-24033 is a high-severity denial of service vulnerability in fastify-multipart, published on 23 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.
Weakness: CWE-770
Which versions are affected by CVE-2025-24033?
4 open source packages ship an affected version, including @fastify/multipart.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/multipart npm | All versions | 8.3.1 |
@fastify/multipart npm | All versions | 8.3.1 |
@fastify/multipart npm | From 9.0.0 | 9.0.3 |
@fastify/multipart npm | From 9.0.0 | 9.0.3 |
How do I fix CVE-2025-24033?
Upgrade @fastify/multipart to a fixed version for your release line: 8.3.1 or 9.0.3.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-24033 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-24033 exists.
Sources
Also known as GHSA-27c6-mcxv-x3fh.