CVE-2026-19484 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary
Remote attackers can cause denial of service by sending crafted multipart requests that stall the Node.js event loop in the @fastify/busboy library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-19484?
CVE-2026-19484 is a high-severity denial of service vulnerability in @fastify/busboy, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.
Which versions are affected by CVE-2026-19484?
2 open source packages ship an affected version, including @fastify/busboy. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@fastify/busboy npm | From 3.1.0 | 3.2.1 |
@fastify/busboy npm | From 3.1.0 | 3.2.1 |
Products include Fastify Fastify\/Busyboy.
How do I fix CVE-2026-19484?
Upgrade @fastify/busboy to 3.2.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-19484 being exploited?
There is no known exploitation of CVE-2026-19484 in the wild and no public exploit code.
Other vulnerabilities in @fastify/busboy
Sources
Also known as GHSA-xjh9-v7x6-24jw, MINI-2hp9-5x3q-wm7h, ROOT-APP-NPM-CVE-2026-19484.