CVE-2026-19481 in busboy
Summary
by MITRE • 08/13/2026
@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in @fastify/busboy affects versions 1.0.0 through 3.2.0 and represents a denial of service condition stemming from improper handling of multipart form-data headers. This parser processes web form submissions containing binary data and is commonly used in Node.js applications for handling file uploads. The flaw occurs when an attacker crafts malicious multipart requests with prototype-inherited property names such as _proto_ or constructor as part header names, which can cause the parser to crash and terminate the application process.
The technical root cause lies in how the internal header parser manages header storage within a plain JavaScript object without proper prototype isolation. When processing headers, the parser assumes each header value is an array for subsequent operations, but when prototype-inherited properties are encountered, they resolve to truthy non-array values that trigger TypeError exceptions during runtime execution. This design flaw creates a condition where legitimate header parsing operations fail catastrophically rather than gracefully handling unexpected input.
The operational impact of this vulnerability extends beyond simple service disruption to potentially terminate Node.js processes in direct usage scenarios, making it particularly dangerous for applications that rely on synchronous processing of form data submissions. While the standard pipe integration surfaces the issue as an error event that can be caught and handled, direct write or end usage patterns cause synchronous exceptions that cannot be recovered from, leading to complete application termination. This vulnerability affects any Node.js application using @fastify/busboy versions within the affected range and presents an unauthenticated denial of service threat.
The fix implemented in version 3.2.1 addresses this through proper prototype isolation by creating the header object with a null prototype, preventing inherited properties from interfering with normal parsing operations. This solution aligns with security best practices for JavaScript object manipulation and follows the principle of least privilege in input validation. Organizations should immediately upgrade to version 3.2.1 or later to mitigate this vulnerability. The issue maps to CWE-471, which covers the use of an incorrect function or method parameter that is not properly validated, and relates to ATT&CK technique T1499.004 for network denial of service through application layer attacks. This vulnerability represents a classic example of prototype pollution affecting server-side applications and demonstrates the critical importance of proper object creation patterns in security-sensitive code paths.