---
id: CVE-2026-19484
title: >-
  fastify/busboy: fastify/busboy: Denial of Service via oversized multipart
  boundary (CVE-2026-19484)
summary: >-
  A flaw was found in @fastify/busboy, a multipart form-data parser. A remote,
  unauthenticated attacker can exploit this by sending a specially crafted
  multipart request with an oversized boundary. This can cause the Node.js event
  loop to st…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-606
  - CWE-835
  - CWE-1322
vendor: Red Hat
product: Red Hat OpenShift AI 3.4
affected:
  - openshift_ai 3.4
patched:
  - openshift_ai 3.4
published: '2026-08-13'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T11:10:22+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19484.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19484.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-19484'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2515196'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-19484'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-19484'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/fastify/busboy/security/advisories/GHSA-xjh9-v7x6-24jw'
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
  - url: >-
      https://github.com/fastify/busboy/commit/632a237e7fb6b3b7a30e0de8fab2ee72ca5bf722
  - url: 'https://github.com/fastify/busboy/releases/tag/v3.2.1'
  - url: 'https://github.com/advisories/GHSA-xjh9-v7x6-24jw'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00615
epssPercentile: 0.49224
aliases:
  - GHSA-xjh9-v7x6-24jw
ecosystem: npm
ingestedAt: '2026-10-02T23:34:57.390Z'
---

## Overview

A flaw was found in @fastify/busboy, a multipart form-data parser. A remote, unauthenticated attacker can exploit this by sending a specially crafted multipart request with an oversized boundary. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant processing resources. Consequently, a single small request can keep a core busy and deny service to other requests handled by the same process.

## Vendor advisories

- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)

**fastify/busboy: fastify/busboy: Denial of Service via oversized multipart boundary** — rated Important by Red Hat. Released 2026-08-13, updated 2026-10-19.

Fixed:

- Red Hat OpenShift AI 3.4

Not affected:

- Red Hat OpenShift AI 3.4
- OpenShift Pipelines
- Red Hat AMQ Broker 7
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat OpenShift Container Platform 4

## Remediation

For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734

## Package advisory (CVE-2026-19484)

Affected packages:

- `@fastify/busboy >= 3.1.0, < 3.2.1`

Patched in:

- `@fastify/busboy 3.2.1`

Source: https://github.com/advisories/GHSA-xjh9-v7x6-24jw