Packages / @fastify/multipart / Security

HighVulnerabilityGHSA-27c6-mcxv-x3fhCVE-2025-24033Published 23 Jan 2025

Unlimited consumption of resources in @fastify/multipart

Affected releases · @fastify/multipart

  • 9.x9.0.0 – 9.0.2Fixed in 9.0.3
  • 8.x8.0.0 – 8.3.0Fixed in 8.3.1
  • 7.x and older6.0.0 – 7.7.3No fix, no longer updated

On 9.x, the newest line:

npm install @fastify/multipart@9.0.3
10.x

  1. Not affected

    10.0.0 – 10.1.6

    8 releases, latest

9.x

  1. Affected

    9.0.0 – 9.0.2

    3 releases

  2. Fixed

    9.0.3 – 9.4.0

    6 releases

8.x

  1. Affected

    8.0.0 – 8.3.0

    4 releases

  2. Fixed

    8.3.1

    1 release

7.x

  1. Affected

    7.0.0 – 7.7.3

    16 releases

6.x

  1. Affected

    6.0.0 – 6.0.1

    2 releases

40 stable releases of @fastify/multipart, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @fastify/multipart. It is read in your browser and sent nowhere.

What happens

Impact

The saveRequestFiles function does not delete the uploaded temporary files when user cancels the request.

Patches

Fixed in version 8.3.1 and 9.0.3

Workarounds

Do not use saveRequestFiles.

References

This was identified in #546 and fixed in #567.