fastify fastify-multipart up to 10.1.0 saveRequestFiles temp file

Summaryinfo

A vulnerability was found in fastify fastify-multipart up to 10.1.0. It has been classified as problematic. This impacts the function saveRequestFiles. Performing a manipulation results in temp file. This vulnerability is reported as CVE-2026-18549. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in fastify fastify-multipart up to 10.1.0. This affects the function saveRequestFiles. The manipulation with an unknown input leads to a temp file vulnerability. CWE is classifying the issue as CWE-377. Creating and using insecure temporary files can leave application and system data vulnerable to attack. This is going to have an impact on availability. The summary by CVE is:

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 5.3.0 up to but not including 10.1.1, when the busboy fileSize limit truncates a file part, the plugin clears its internal current-file reference while the underlying stream is still open. If the client then aborts the connection before sending the terminating boundary, the abort cleanup finds no stream to destroy, so saveRequestFiles() never settles, the request handler hangs, and the temporary file already written to disk is never cleaned up. An unauthenticated client can repeat this to permanently leak temporary files and suspended handler executions, leading to disk and event-loop exhaustion. The issue is fixed in @fastify/multipart 10.1.1. Users should upgrade to 10.1.1.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-18549 since 08/01/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 10.1.1 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-59759). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• fastify

Name

• fastify-multipart

Version

• 10.0
• 10.1.0

Website

• Product: https://github.com/fastify/fastify-multipart/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion