Packages / @fastify/multipart / Security

HighVulnerabilityGHSA-hpp2-2cr5-pf6gCVE-2023-25576Published 14 Feb 2023

Denial of service due to unlimited number of parts

Affected releases · @fastify/multipart

  • 7.x7.0.0 – 7.4.0Fixed in 7.4.1
  • 6.x6.0.0Fixed in 6.0.1

On 7.x, the newest line:

npm install @fastify/multipart@7.4.1
10.x

  1. Not affected

    10.0.0 – 10.1.6

    8 releases, latest

7.x

  1. Affected

    7.0.0 – 7.4.0

    7 releases

  2. Fixed

    7.4.1 – 7.7.3

    9 releases

6.x

  1. Affected

    6.0.0

    1 release

  2. Fixed

    6.0.1

    1 release

40 stable releases of @fastify/multipart, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @fastify/multipart. It is read in your browser and sent nowhere.

What happens

Impact

  • The multipart body parser accepts an unlimited number of file parts.

  • The multipart body parser accepts an unlimited number of field parts.

  • The multipart body parser accepts an unlimited number of empty parts as field parts.

Patches

This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x).

Workarounds

There are no known workaround.

References

Reported at hackerone.com/reports/1816195.