CVE-2026-19474 in fastify-multipart
Summary
by MITRE • 08/15/2026
@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that occurs between parts falls outside the per-file cleanup path, so an earlier completed file is never removed. An unauthenticated client can repeat this to cause persistent, linear disk consumption, leading to denial of service. This is an incomplete-fix variant of CVE-2025-24033. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability exists within the @fastify/multipart package, a critical component responsible for parsing multipart form-data requests in Fastify web applications. This issue affects versions from 3.0.0 through 10.1.0, creating a persistent security concern that enables malicious actors to exploit resource exhaustion through deliberate client disconnections during multipart processing. The flaw manifests when the request.saveRequestFiles() method encounters an iterator rejection occurring between multipart parts, which creates a condition where completed temporary files are not properly removed from disk storage.
The technical mechanism behind this vulnerability involves the multipart parser's handling of asynchronous operations and cleanup procedures. When a client disconnects mid-parsing, the iterator rejection occurs outside the standard per-file cleanup pathway, resulting in temporary files that were already processed being left behind on the filesystem. This represents a classic resource leak scenario where temporary file handles are not properly closed or removed, creating a cumulative effect that grows with each affected request. The vulnerability operates at the intersection of asynchronous programming patterns and file system management within HTTP request processing pipelines.
The operational impact of this vulnerability extends beyond simple resource consumption to create a potential denial of service condition that can be systematically exploited by unauthenticated attackers. Each successful exploitation results in linear disk consumption, where multiple temporary files accumulate over time until system resources are exhausted. This creates a persistent threat that does not require authentication, making it particularly dangerous for publicly accessible web services. The vulnerability's incomplete nature as a variant of CVE-2025-24033 indicates that previous mitigation attempts were insufficient to address all failure modes within the cleanup process.
Security implications align with common attack patterns found in resource exhaustion and denial of service scenarios, where attackers can consume system resources to disrupt normal operations. The vulnerability demonstrates poor error handling in asynchronous file management contexts, representing a CWE-400 (Uncontrolled Resource Consumption) classification. From an ATT&CK framework perspective, this issue maps to T1499.004 (Endpoint Denial of Service) and potentially T1566.002 (Phishing with Malicious Attachment), as it could be leveraged as part of broader attack chains targeting system availability. The attack vector requires minimal privileges and can be executed repeatedly, making it particularly effective for sustained disruption.
The fix implemented in @fastify/multipart version 10.1.1 addresses the core issue by ensuring proper cleanup of temporary files regardless of iterator rejection conditions between multipart parts. This update modifies the file management logic to guarantee that all completed temporary files are removed from disk storage, even when asynchronous operations encounter failures or interruptions. Organizations should prioritize upgrading to version 10.1.1 as an immediate remediation measure, while also implementing monitoring for unusual disk consumption patterns that might indicate exploitation attempts. Additional defensive measures include rate limiting for multipart requests and filesystem monitoring to detect abnormal file creation patterns in temporary directories.
The vulnerability serves as a reminder of the critical importance of proper resource management in asynchronous web applications, particularly when dealing with temporary file operations during request processing. It highlights how seemingly minor issues in error handling can compound into significant security concerns, emphasizing the need for comprehensive testing of edge cases and cleanup procedures. The fix demonstrates the necessity of robust error boundaries and defensive programming practices that ensure cleanup operations execute reliably regardless of execution path variations or unexpected interruptions during asynchronous processing.