Vulnerability · Published Feb 14, 2023 · Assigned by GitHub_M
CVE-2023-25576@fastify/multipart vulnerable to DoS due to unlimited number of parts
High 7.5
In plain English
A high-severity resource allocation without limits in fastify-multipart from fastify. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @fastify/multipart | 6.0.1 | GHSA-hpp2-2cr5-pf6g |
| npm | @fastify/multipart | 7.4.1 | GHSA-hpp2-2cr5-pf6g |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| fastify | fastify-multipart | < 6.0.1>= 7.0.0, < 7.4.1 |
Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g x_refsource_CONFIRM
- https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297 x_refsource_MISC
- https://hackerone.com/reports/1816195 x_refsource_MISC
- https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1 x_refsource_MISC
- https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1 x_refsource_MISC