Prototype Pollution in @fastify/busboy

Executive Summary

This vulnerability affects @fastify/busboy versions 1.0.0 through 3.2.0. An attacker can crash the multipart form-data parser by sending a part header with a prototype-inherited property name like __proto__ or constructor. The parser stores headers in a plain JavaScript object and expects array values, so inherited properties trigger a TypeError. This causes a denial of service by crashing the Node.js process if uncaught.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the version of @fastify/busboy in your project. If you are using versions 1.0.0 through 3.2.0, the system is vulnerable. Run 'npm list @fastify/busboy' or check your package.json to verify the installed version.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to crash the Node.js process by submitting malicious multipart form-data. If the application uses direct write() or end() methods, the crash happens immediately. If using req.pipe(busboy), it triggers an error event. Without proper error handling, the service becomes unavailable, causing downtime.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade @fastify/busboy to version 3.2.1 or later using 'npm update @fastify/busboy'. If upgrading is not possible, attach an error listener to the Busboy stream or wrap direct write() or end() calls in try/catch blocks to prevent process crashes.

Useful 0 Not Useful 0