Unlimited consumption of resources in @fastify/multipart
### Impact The `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. ### Patches Fixed in version 8.3.1 and 9.0.3 ### Workarounds Do not use `saveRequestFiles`. ### References This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-24033US | — | — | ||
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded tempo… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/fastify/fastify-multipartPACKAGE
- https://github.com/fastify/fastify-multipart/issues/546WEB
- https://github.com/fastify/fastify-multipart/pull/567WEB
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fhWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-24033ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan