---
id: CVE-2026-18549
title: '@fastify/multipart is a multipart form-data parser for Fastify'
summary: >-
  @fastify/multipart is a multipart form-data parser for Fastify. In versions
  from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit
  truncates a file part, the plugin clears its internal current-file reference
  while the …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-664
published: '2026-08-15'
updated: '2026-08-15'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18549'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/fastify/fastify-multipart/security/advisories/GHSA-vmph-573x-85f6
    label: ce714d77-add3-4f53-aff5-83d477b104bb
tags:
  - nvd
ingestedAt: '2026-08-16T13:39:02.936Z'
epss: 0.00603
epssPercentile: 0.46536
---

## Overview

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.