Integer Underflow in facil.io MIME Parser

Executive Summary

CVE-2026-66729 is an integer underflow vulnerability in the facil.io library's multipart MIME body parser. It occurs when a crafted Content-Disposition header with an empty field name triggers a uint32_t wraparound in http_mime_parser.h. This causes an out-of-bounds memory read, leading to a bus fault that crashes the server process with a single POST request.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for server crashes when processing multipart form-data POST requests with malformed Content-Disposition headers containing empty field names. Check server logs for bus faults or segmentation faults during HTTP request handling.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated remote attackers to crash the server process by sending a malformed request. In multi-worker setups, only the affected worker crashes, but the master process respawns it. In single-worker setups, the entire server goes offline. It does not lead to information disclosure as the crash occurs before data processing.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade facil.io to a patched version that includes the zero-length guard fix in http_mime_parser.h. If upgrading is not possible, implement network-level mitigations such as WAF rules to block malformed multipart requests with empty Content-Disposition field names.

Useful 0 Not Useful 0