{"id":"CVE-2026-19484","title":"fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary (CVE-2026-19484)","summary":"A flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to st…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-606","CWE-835","CWE-1322"],"vendor":"Red Hat","product":"Red Hat OpenShift AI 3.4","affected":["openshift_ai 3.4"],"patched":["openshift_ai 3.4"],"published":"2026-08-13","updated":"2026-10-19","sourceUpdated":"2026-10-19T11:10:22+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19484.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19484.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19484"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515196"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19484"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19484"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"},{"url":"https://github.com/fastify/busboy/commit/632a237e7fb6b3b7a30e0de8fab2ee72ca5bf722"},{"url":"https://github.com/fastify/busboy/releases/tag/v3.2.1"},{"url":"https://github.com/advisories/GHSA-xjh9-v7x6-24jw"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00615,"epssPercentile":0.49224,"aliases":["GHSA-xjh9-v7x6-24jw"],"ecosystem":"npm","ingestedAt":"2026-10-02T23:34:57.390Z","slug":"CVE-2026-19484","body":"## Overview\n\nA flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant processing resources. Consequently, a single small request can keep a core busy and deny service to other requests handled by the same process.\n\n## Vendor advisories\n\n- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)\n\n**fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary** — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.\n\nFixed:\n\n- Red Hat OpenShift AI 3.4\n\nNot affected:\n\n- Red Hat OpenShift AI 3.4\n- OpenShift Pipelines\n- Red Hat AMQ Broker 7\n- Red Hat Ceph Storage 8\n- Red Hat Ceph Storage 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734\n\n## Package advisory (CVE-2026-19484)\n\nAffected packages:\n\n- `@fastify/busboy >= 3.1.0, < 3.2.1`\n\nPatched in:\n\n- `@fastify/busboy 3.2.1`\n\nSource: https://github.com/advisories/GHSA-xjh9-v7x6-24jw","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}