High severity · published Feb 14, 2023
CVE-2023-25576
@fastify/multipart is a Fastify plugin to parse the multipart content-type
7.5
CVSS
1.5%
EPSS
No
On KEV
Description
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Fastify-multipart · Fastify
before 6.0.1; 7.0.0 before 7.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-25576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-25576
Patch
https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297
Release Notes
https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1
Release Notes
https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1
Third Party Advisory
https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g
Permissions Required
https://hackerone.com/reports/1816195
More from Fastify-multipart
7.5
CVE-2026-19474
@fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload
7.5
CVE-2026-18549
@fastify/multipart vulnerable to Denial of Service via aborted upload after fileSize limit
7.5
CVE-2021-23597
This affects the package fastify-multipart before 5.3.1
7.5
CVE-2020-8136
Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request