CVE-2026-19474

Analyzed Analyzed - Analysis Complete

Denial of Service in Fastify Multipart via Unremoved Temporary Files

Publication date: 2026-08-15

Last updated on: 2026-09-02

Assigner: openjs

Description

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-09-02

Generated

2026-09-05

AI Q&A

2026-08-16

EPSS Evaluated

2026-09-04

NVD

CVE-2026-19474

EUVD

EUVD-2026-59761

Affected Vendors & Products

Vendor	Product	Version / Range
fastify	fastify-multipart	From 3.0.0 (inc) to 10.1.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @fastify/multipart package, which is used to parse multipart form-data in Fastify applications. When a client disconnects during file upload processing, temporary files may remain on disk. The cleanup process fails to remove completed files between parts, allowing an attacker to repeatedly trigger this behavior and consume disk space, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking if your system is running a vulnerable version of @fastify/multipart (3.0.0 to 10.1.0). Inspect your project's package.json or run npm list @fastify/multipart to verify the installed version. Monitor disk usage for unexplained growth, particularly in temporary file directories, as this may indicate exploitation.

Impact Analysis

An unauthenticated attacker could exploit this to fill up disk space on the server by repeatedly uploading files and disconnecting prematurely. This can cause the server to run out of storage, disrupting normal operations and potentially taking services offline.

Compliance Impact

This vulnerability could lead to denial of service due to persistent disk consumption from incomplete file cleanup. For GDPR, this may violate Article 32 on security of processing if it risks unauthorized access or loss of availability. For HIPAA, it could affect integrity and availability requirements under the Security Rule if systems storing protected health information become unavailable.

Mitigation Strategies

Upgrade @fastify/multipart to version 10.1.1 or later immediately. If upgrading is not possible, implement strict rate limiting and client disconnection handling to reduce the risk of disk exhaustion. Regularly clean temporary files and monitor disk space to detect abnormal usage patterns.

Hi! I’m here to help you understand CVE-2026-19474. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70