Vulnerability · Published Jan 23, 2025 · Assigned by GitHub_M

CVE-2025-24033@fastify/multipart vulnerable to unlimited consumption of resources

High 7.5

In plain English

A high-severity resource allocation without limits in fastify-multipart from fastify. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.6%top 51.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@fastify/multipart	8.3.1	GHSA-27c6-mcxv-x3fh
npm	@fastify/multipart	9.0.3	GHSA-27c6-mcxv-x3fh

Affected products (as reported)

Vendor	Product	Versions
fastify	fastify-multipart	< 8.3.1>= 9.0.0, < 9.0.3

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fh x_refsource_CONFIRM
https://github.com/fastify/fastify-multipart/issues/546 x_refsource_MISC
https://github.com/fastify/fastify-multipart/pull/567 x_refsource_MISC