Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117531— @fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

Quick assessment

Affected
@fastify/multipart @fastify/multipart
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

是 Fastify Web 框架的多部分表单数据（multipart form-data）和文件上传插件。在 5.3.0 至 10.1.6 版本中，当请求体在文件部分内部结束且缺少结束边界（closing boundary）时，即使 Content-Length 已完整、客户端未中断连接且未超出文件大小限制，该插件也不会将解析错误传播到文件流。相反，插件会直接销毁正在进行的文件流且不抛出错误。因此，任何在遍历请求各部分后、在消费文件之前执行异步操作的处理器，将会绑定到一个既不会发出错误事件也不会发出结束事件的流上，

CVSS 5.9 · Medium

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117531

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/multipart @fastify/multipart 5.3.0 ~ 10.1.7 -

II. Public POCs for CVE-2026-117531

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117531

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-117531 (1)

IV. Related Vulnerabilities

Same product: @fastify/multipart
Same vendor: @fastify/multipart
Same weakness: CWE-400