Impact
Versions of @fastify/busboy from 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named __proto__ or constructor resolves to an inherited value that is not an array, and the parser throws TypeError: this.header[h].push is not a function. Through the documented req.pipe(busboy) integration this surfaces as an error event, while direct write()/end() usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected.
Patches
Fixed in version 3.2.1.
Workarounds
Attach an error listener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap direct write()/end() calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.
References
kq5y Reporter
mcollina Remediation developer
UlisesGascon Remediation reviewer
AdmirBajric Reporter
Impact
Versions of
@fastify/busboyfrom 1.0.0 and prior to 3.2.1 are vulnerable to a Denial of Service. The multipart header parser stores part-header names on a plain JavaScript object, so a part header named__proto__orconstructorresolves to an inherited value that is not an array, and the parser throwsTypeError: this.header[h].push is not a function. Through the documentedreq.pipe(busboy)integration this surfaces as anerrorevent, while directwrite()/end()usage throws synchronously and can terminate the Node.js process if uncaught. The parser runs before application middleware, so any unauthenticated client that can submit multipart/form-data is affected.Patches
Fixed in version 3.2.1.
Workarounds
Attach an
errorlistener to the Busboy stream so the parser failure is handled rather than crashing the process, and wrap directwrite()/end()calls in a try/catch. Upgrading to 3.2.1 removes the failure entirely.References