@fastify/multipart vulnerabilities

CVEs whose affected-version data names the @fastify/multipart package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-117531Medium· 5.9

6d ago

@fastify/multipart vulnerable to Denial of Service via a malformed upload hanging delayed file consumers

@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file …

▾ Sunlit@fastify/multipart · @fastify/multipartEPSS 0.33%via CVEORG