Unlimited consumption of resources in @fastify/multipart
### Impact The `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. ### Patches Fixed in version 8.3.1 and 9.0.3 ### Workarounds Do not use `saveRequestFiles`. ### References This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-24033US | — | — | ||
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded tempo… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/fastify/fastify-multipartPACKAGE
- https://github.com/fastify/fastify-multipart/issues/546WEB
- https://github.com/fastify/fastify-multipart/pull/567WEB
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fhWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-24033ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan