CVE-2026-19484High· 7.5▾ TwilightA flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to st…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.6%
Last analysed / modified upstream
A flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant processing resources. Consequently, a single small request can keep a core busy and deny service to other requests handled by the same process.
fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.
Fixed:
Not affected:
For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:
https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734
Affected packages:
@fastify/busboy >= 3.1.0, < 3.2.1Patched in:
@fastify/busboy 3.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-19481High· 7.5fastify/busboy: fastify/busboy: Denial of Service from crafted form-data headers (CVE-2026-19481)
CVE-2026-18446High· 7.5fast-uri: fast-uri: Host confusion vulnerability via backslash in URI authority (CVE-2026-18446)
CVE-2026-59874High· 7.5tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
CVE-2026-48712High· 7.5protobufjs: protobufjs: Denial of Service via uncontrolled recursion with crafted protobuf payload (CVE-2026-48712)
CVE-2026-81724High· 7.5nltk: NLTK: Denial of Service via Uncontrolled Recursion (CVE-2026-81724)
CVE-2026-81722High· 7.5nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing (CVE-2026-81722)