CVE-2026-19474

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

• CWE-459
• CWE-770

• https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
• https://github.com/fastify/fastify-multipart/security/advisories/GHSA-62qx-hpj5-j6hcMitigation, Vendor Advisory

Published

Aug 15, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-19453The JetBackup WordPress plugin before 3.1.23.5 does not ver…7.1
• CVE-2026-19454The JetBackup WordPress plugin before 3.1.23.5 does not per…4.4
• CVE-2026-1946The GW AI Website Builder plugin for WordPress is vulnerable…4.3
• CVE-2026-1947The NEX-Forms – Ultimate Forms Plugin for WordPress plugin f…7.5
• CVE-2026-19471Multiple stored cross-site scripting security issues exist w…6.9
• CVE-2026-19472A denial-of-service security issue exists within ArmorStart®…8.7
• CVE-2026-19475An authenticated user with permission to query a SQL data so…6.5
• CVE-2026-19478GitLab has remediated an issue in GitLab CE/EE affecting all…9.1
• CVE-2026-19479Adobe Experience Manager is affected by a DOM-based Cross-Si…5.4
• CVE-2026-1948The NEX-Forms – Ultimate Forms Plugin for WordPress plugin f…4.3
• CVE-2026-19481@fastify/busboy is a multipart form-data parser. In versions…7.5
• CVE-2026-19483IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 throu…5.5