CVE-2026-19481High· 7.5▾ TwilightA flaw was found in @fastify/busboy, a multipart form-data parser. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers. This can cause a TypeError in the parser, leading to the terminat…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.5%
Last analysed / modified upstream
A flaw was found in @fastify/busboy, a multipart form-data parser. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers. This can cause a TypeError in the parser, leading to the termination of the Node.js process and resulting in an unauthenticated Denial of Service (DoS).
fastify/busboy: fastify/busboy: Denial of Service from crafted form-data headers — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.
Affected:
Fixed:
No fix planned:
Not affected:
For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734
Workarounds / mitigations:
Affected packages:
@fastify/busboy >= 1.0.0, < 3.2.1Patched in:
@fastify/busboy 3.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19484High· 7.5fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary (CVE-2026-19484)
CVE-2026-18446High· 7.5fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority (CVE-2026-18446)
CVE-2026-19693High· 8.1extract-zip: extract-zip: Arbitrary file write via symlink in archive (CVE-2026-19693)
CVE-2026-55685Medium· 6.5react-router: @remix-run/server-runtime: React Router: Denial of Service via unauthenticated manifest endpoint requests (CVE-2026-55685)
CVE-2026-47219High· 7.5find-my-way: find-my-way: Denial of Service vulnerability in HTTP/2 server (CVE-2026-47219)
CVE-2026-13311Medium· 6.5shell-quote: shell-quote/parse: shell-quote: Denial of Service due to inefficient input parsing (CVE-2026-13311)