CVE-2026-66730 in facil.io
Summary
by MITRE • 07/27/2026
facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error flags, causing the calling loop to re-invoke the parser on the same buffer indefinitely, exhausting all workers and permanently disabling the server until manually restarted.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/27/2026
The vulnerability exists within facil.io versions 0.6.0 through 0.7.6, specifically in the multipart body parser implementation that handles multipart/form-data requests. This denial-of-service weakness stems from a fundamental flaw in how the parser manages boundary detection and buffer processing during HTTP request parsing operations. The issue manifests when an unauthenticated remote attacker crafts a malicious multipart/form-data request containing a partial closing boundary, which triggers the vulnerable code path that lacks proper progress monitoring mechanisms.
The technical root cause lies in the http_mime_parse function's behavior when encountering malformed multipart boundaries. When the parser encounters what it perceives as a partial closing boundary, it returns zero bytes consumed from the input buffer while failing to set either the done or error flags that would normally signal completion or failure conditions to the calling loop. This design flaw creates an infinite loop scenario where the calling function continuously invokes the same parser with identical buffer content, resulting in perpetual CPU utilization without making meaningful progress on request processing.
The operational impact of this vulnerability is severe and permanent for affected systems. Worker processes become trapped in an infinite loop consuming 100% CPU resources indefinitely, effectively rendering the server incapable of processing any additional requests until manual intervention occurs through server restart operations. This creates a persistent denial-of-service condition that can be triggered remotely without authentication requirements, making it particularly dangerous in production environments where continuous availability is critical.
This vulnerability aligns with CWE-835, which describes the weakness of an infinite loop without a progress check, and demonstrates characteristics consistent with ATT&CK technique T1499.004 for network denial-of-service attacks. The absence of proper progress guards in the parser loop represents a classic security anti-pattern where defensive mechanisms fail to prevent resource exhaustion through malformed input processing. Organizations running facil.io within this vulnerable version range face significant risk of service disruption and potential business impact from this persistent CPU starvation attack vector.
The recommended mitigations include immediate upgrade to a patched version of facil.io that implements proper progress tracking in the multipart parser, deployment of rate limiting and request size restrictions at proxy layers, and implementation of monitoring systems that can detect and alert on sustained high CPU utilization patterns. Additionally, input validation and boundary checking mechanisms should be strengthened to prevent malformed multipart data from reaching vulnerable parsing functions, while network-level protections such as web application firewalls can provide additional defense-in-depth measures against exploitation attempts.