Denial-of-Service in facil.io Multipart Parser

Executive Summary

This is an infinite loop denial-of-service (DoS) vulnerability in the facil.io MIME parser affecting versions 0.6.0 through 0.7.6. An unauthenticated remote attacker can freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary, causing the parser to repeatedly process the same buffer without consuming bytes or setting completion flags, leading to an infinite loop.

Useful 0 Not Useful 0

Detection Guidance

Monitor for sustained 100% CPU usage in facil.io worker processes, particularly when handling multipart/form-data requests. Check server logs for POST requests with partial closing boundaries like '--B-' instead of '--B--\r\n'. Use network traffic analysis tools to detect malformed multipart requests targeting facil.io endpoints.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an attacker to permanently disable server worker processes until manually restarted. This can cause service outages, degrade performance, and require administrative intervention to recover. Systems relying on facil.io for handling multipart/form-data requests are particularly at risk.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade facil.io to a patched version if available. Implement rate limiting on multipart/form-data endpoints. Add network-level protections to block malformed multipart requests with partial boundaries. Temporarily disable multipart parsing if not essential until patched.

Useful 0 Not Useful 0