@fastify/multipart Denial of Service (DoS) Vulnerability via Unpropagated Parser Errors (CVE-2026-117531)
Executive & SecOps Summary
SECOPS ASSESSMENTFastify web applications utilizing @fastify/multipart versions 5.3.0 through 10.1.6
Unauthenticated remote attackers can cause resource exhaustion and Denial of Service (DoS) by hanging server connections
Immediately upgrade the @fastify/multipart package to version 10.1.7 or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
There is no workaround other than upgrading the package. Update @fastify/multipart to version 10.1.7 or later using your package manager:
# For npm users
npm install @fastify/multipart@10.1.7 --save
# For yarn users
yarn upgrade @fastify/multipart@10.1.7
# For pnpm users
pnpm update @fastify/multipart@10.1.72. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not possible, mitigate the risk at the reverse proxy or Web Application Firewall (WAF) layer by enforcing strict request timeouts and connection limits.
# Nginx mitigation configuration example
http {
# Reduce timeouts to prevent long-lived hung connections
client_body_timeout 10s;
client_header_timeout 10s;
keepalive_timeout 15s;
# Limit concurrent connections per IP address
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
server {
location /upload {
limit_conn conn_limit_per_ip 5;
proxy_pass http://fastify_backend;
}
}
}3. Log Audit & IoC Verification Commands
Verify the installed version of @fastify/multipart and monitor your application for hung connections or abnormal timeouts.
# Check the installed version of @fastify/multipart in your project
npm list @fastify/multipart
# Example of implementing an application-level request timeout hook in Fastify
const fastify = require('fastify')();
fastify.addHook('onRequest', (request, reply, done) => {
const timeoutLimit = 30000; // 30 seconds
const timeoutId = setTimeout(() => {
if (!reply.sent) {
request.log.error({ ip: request.ip }, 'Request timeout exceeded - potential connection hang');
reply.code(408).send({ error: 'Request Timeout' });
}
}, timeoutLimit);
reply.raw.on('finish', () => clearTimeout(timeoutId));
done();
});Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2026-117531) is a resource exhaustion issue (CWE-400) in @fastify/multipart, the multipart form-data and file upload plugin for the Fastify web framework. The root cause lies in the plugin's failure to propagate a parser error to the file stream when a request body ends abruptly inside a file part without a closing boundary, even if the Content-Length is complete and the client does not abort. Because the plugin destroys the in-progress file stream without emitting an error, any handler that performs asynchronous operations before consuming the file stream attaches to a stream that never emits an error or end event, causing the request to hang indefinitely.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by sending malformed multipart upload requests. The attacker crafts a request where the body terminates prematurely within a file part, omitting the closing boundary, while keeping the connection open. If the target application employs a delayed file consumer pattern (e.g., performing database queries or authentication checks before reading the stream), the handler waits indefinitely for the stream to settle. By repeating these malformed uploads, the attacker can accumulate pending connections, exhaust server resources, and render the application unavailable to legitimate users.
3. Infrastructure & Business Impact
While this vulnerability does not compromise data confidentiality or integrity, it poses a severe threat to service availability. A relatively low volume of malicious requests can exhaust the Node.js event loop or available socket connections, leading to a complete denial of service. This can result in significant operational downtime, SLA breaches, and loss of user trust.
Official Vendor Advisories & References
@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.
Frequently Asked SecOps Questions (CVE-2026-117531)
FAQQ1. How critical is CVE-2026-117531 and is it actively exploited in the wild?
CVE-2026-117531 is rated CVSS 5.9 (MEDIUM) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-117531?
Primary impacted vendors include fastify across @fastify/multipart. Scope summary: All installations of @fastify/multipart from version 5.3.0 up to 10.1.6
Q3. What temporary mitigations or workarounds exist for CVE-2026-117531 before patching?
[Mitigation] Immediately upgrade the @fastify/multipart package to version 10.1.7 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-117531
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (fastify)
View Category →@fastify/reply-from Path Traversal and Proxy Bypass Vulnerability (CVE-2026-117518)
[Affected Scope] Node.js applications utilizing @fastify/reply-from versions up to and including 12.8.0
@fastify/secure-session Signature Verification Bypass and Session Invalidation Evasion (CVE-2026-117549)
[Affected Scope] Node.js applications using @fastify/secure-session versions 7.5.0 through 8.4.1 configured with the signed cookie option
Aedes MQTT Broker Denial of Service (DoS) via Excessive Topic Depth (CVE-2026-63341)
[Affected Scope] All Node.js environments running Aedes MQTT broker versions prior to 1.1.1.
Delgan Loguru 0.7.3 ANSI Color-Markup Parser Regular Expression Denial of Service (ReDoS) Vulnerability (CVE-2026-120217)
[Affected Scope] Delgan Loguru library version 0.7.3 and prior
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.