Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74866— @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Quick assessment

Affected
@fastify/busboy @fastify/busboy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

@fastify/busboy 是 Node.js 的一个 multipart 表单数据解析器。其 multipart 部分头部解析器仅在双字节字符序列“回车-换行”（CRLF）处对头部行进行拆分，因此嵌入在部分头部中的单个回车符或换行符不会被视作行分隔符，而是会原样传递到解析后的 Content-Disposition 文件名和字段名中，并交由应用程序使用。攻击者可以上传一个文件名或字段名中包含裸回车符或换行符的文件，从而向那些依赖该解析器返回“干净”值的消费者注入控制字符，导致文件系统文件名污染、日志伪造或头部

CVSS 5.8 · Medium EPSS 0.19% · P9

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 2

VendorProduct Version RangeStatus
@fastify/busboy @fastify/busboy < 3.2.2 affected
3.2.2 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74866

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Source: CVE Program / CVE List V5
Vulnerability Description
@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对CRLF序列的转义处理不恰当(CRLF注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
@fastify/busboy @fastify/busboy 0 ~ 3.2.2 -

II. Public POCs for CVE-2026-74866

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74866

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-74866 (1)

IV. Related Vulnerabilities

Same product: @fastify/busboy
Same vendor: @fastify/busboy
Same weakness: CWE-93

V. Comments for CVE-2026-74866

No comments yet

Leave a comment