CVE-2026-18549

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

• CWE-400
• CWE-664

• https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
• https://github.com/fastify/fastify-multipart/security/advisories/GHSA-vmph-573x-85f6Mitigation, Vendor Advisory

Published

Aug 15, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18536Data::Entropy versions before 0.010 for Perl read remote ent…7.5
• CVE-2026-1854The Post Flagger plugin for WordPress is vulnerable to Store…6.4
• CVE-2026-18540undici's retry interceptor can append the body of a ranged r…3.7
• CVE-2026-18544IBM Portieris 0.5.0 through 0.14.2 could allow a remote auth…8.1
• CVE-2026-18545IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to serve…4.3
• CVE-2026-18547The Ultimate Member – User Profile, Registration, Login, Mem…6.4
• CVE-2026-18550The Nokri - Job Board WordPress Theme for WordPress is vulne…9.8
• CVE-2026-18554IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote …7.5
• CVE-2026-18555The Better Messages – Chat Rooms, Group Chat, Private Messag…6.1
• CVE-2026-18556Authentication bypass using an alternate path or channel vul…7.4
• CVE-2026-1856The Appointment Booking Calendar plugin for WordPress is vul…6.4
• CVE-2026-18561The Unlimited Elements For Elementor plugin for WordPress is…7.5