CVE-2026-19474

Received Received - Intake

Denial of Service in Fastify Multipart via Unremoved Temporary Files

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: openjs

Description

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-15

Generated

2026-08-16

AI Q&A

2026-08-16

EPSS Evaluated

N/A

NVD

CVE-2026-19474

EUVD

EUVD-2026-59761

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	multipart	From 3.0.0 (inc) to 10.1.1 (exc)
fastify	multipart	10.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @fastify/multipart package, which is used to parse multipart form-data in Fastify applications. When a client disconnects during file upload processing, temporary files may remain on disk. The cleanup process fails to remove completed files between parts, allowing an attacker to repeatedly trigger this behavior and consume disk space, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking if your system is running a vulnerable version of @fastify/multipart (3.0.0 to 10.1.0). Inspect your project's package.json or run npm list @fastify/multipart to verify the installed version. Monitor disk usage for unexplained growth, particularly in temporary file directories, as this may indicate exploitation.

Impact Analysis

An unauthenticated attacker could exploit this to fill up disk space on the server by repeatedly uploading files and disconnecting prematurely. This can cause the server to run out of storage, disrupting normal operations and potentially taking services offline.

Mitigation Strategies

Upgrade @fastify/multipart to version 10.1.1 or later immediately. If upgrading is not possible, implement strict rate limiting and client disconnection handling to reduce the risk of disk exhaustion. Regularly clean temporary files and monitor disk space to detect abnormal usage patterns.

Hi! I’m here to help you understand CVE-2026-19474. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70