{"id":"CVE-2026-19481","title":"fastify/busboy: fastify/busboy: Denial of Service from crafted form-data headers (CVE-2026-19481)","summary":"A flaw was found in @fastify/busboy, a multipart form-data parser. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers. This can cause a TypeError in the parser, leading to the terminat…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-915","CWE-754"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["openshift_pipelines","ceph_storage 8","ceph_storage 9","openshift_ai 3.4"],"patched":["openshift_ai 3.4"],"published":"2026-08-13","updated":"2026-10-19","sourceUpdated":"2026-10-19T11:10:20+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19481.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19481.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19481"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515192"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19481"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19481"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b"},{"url":"https://github.com/fastify/busboy/releases/tag/v3.2.1"},{"url":"https://github.com/advisories/GHSA-x8mw-p69m-v3mx"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00493,"epssPercentile":0.42159,"aliases":["GHSA-x8mw-p69m-v3mx"],"ecosystem":"npm","ingestedAt":"2026-10-02T23:34:57.391Z","slug":"CVE-2026-19481","body":"## Overview\n\nA flaw was found in @fastify/busboy, a multipart form-data parser. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers. This can cause a TypeError in the parser, leading to the termination of the Node.js process and resulting in an unauthenticated Denial of Service (DoS).\n\n## Vendor advisories\n\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n- **Red Hat VEX** · Important · affected: OpenShift Pipelines, Red Hat Ceph Storage 8, Red Hat Ceph Storage 9 · no fix planned: Red Hat Ceph Storage 8, Red Hat Ceph Storage 9, OpenShift Pipelines · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19481.json)\n\n**fastify/busboy: fastify/busboy: Denial of Service from crafted form-data headers** — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.\n\nAffected:\n\n- OpenShift Pipelines\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n\nFixed:\n\n- Red Hat OpenShift AI 3.4\n\nNo fix planned:\n\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- OpenShift Pipelines\n\nNot affected:\n\n- Red Hat OpenShift AI 3.4\n- Red Hat AMQ Broker 7\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\n\n## Package advisory (CVE-2026-19481)\n\nAffected packages:\n\n- `@fastify/busboy >= 1.0.0, < 3.2.1`\n\nPatched in:\n\n- `@fastify/busboy 3.2.1`\n\nSource: https://github.com/advisories/GHSA-x8mw-p69m-v3mx","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}