CVE-2025-24033: Fastify Multipart Information Disclosure

CVE-2025-24033 Overview

CVE-2025-24033 is a resource exhaustion vulnerability in @fastify/multipart, a Fastify plugin for parsing multipart content-type data. The vulnerability exists in the saveRequestFiles function, which fails to delete uploaded temporary files when a user cancels the request mid-upload. This behavior can lead to disk space exhaustion on servers handling file uploads, potentially causing denial of service conditions.

Critical Impact

Attackers can exploit this vulnerability to consume all available disk space on affected servers by repeatedly initiating and canceling file upload requests, leading to service disruption and potential system instability.

Affected Products

• @fastify/multipart versions prior to 8.3.1
• @fastify/multipart versions 9.x prior to 9.0.3
• Fastify applications using the saveRequestFiles function

Discovery Timeline

• 2025-01-23 - CVE CVE-2025-24033 published to NVD
• 2025-01-23 - Last updated in NVD database

Technical Details for CVE-2025-24033

Vulnerability Analysis

This vulnerability stems from improper resource management (CWE-770: Allocation of Resources Without Limits or Throttling) within the @fastify/multipart plugin. The saveRequestFiles function is designed to handle multipart file uploads by temporarily storing files on the server's filesystem. However, when a client abruptly terminates or cancels an upload request, the function fails to properly clean up the partially uploaded temporary files.

Over time, or through deliberate exploitation, this can result in significant disk space consumption. An attacker with network access can exploit this flaw by repeatedly initiating file upload requests and immediately canceling them, causing temporary files to accumulate without being cleaned up. Since no authentication or special privileges are required to trigger this behavior, the vulnerability is accessible to any remote attacker who can reach the affected endpoint.

Root Cause

The root cause lies in the cleanup logic of the saveRequestFiles function. When a request is completed normally, the function properly handles temporary file deletion. However, the event handlers for client disconnection or request abortion do not trigger the necessary cleanup routines. This oversight means that any interrupted upload leaves orphaned files in the temporary directory.

The vulnerability is classified under CWE-770 because the application allocates filesystem resources (temporary files) without implementing proper limits or cleanup mechanisms for abnormal request termination scenarios.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an endpoint in a Fastify application that uses saveRequestFiles for handling multipart uploads
2. Initiating multiple concurrent file upload requests to the vulnerable endpoint
3. Abruptly terminating each connection before the upload completes
4. Repeating this process to exhaust available disk space on the target server

The attack is particularly effective because each canceled request consumes a portion of disk space that is never reclaimed, and there are no built-in rate limits or cleanup mechanisms to mitigate the accumulation.

Detection Methods for CVE-2025-24033

Indicators of Compromise

• Unusual growth in the size of temporary directories on servers running Fastify applications
• Abnormally high number of incomplete or orphaned files in the temporary upload directory
• Increased disk utilization without corresponding increase in legitimate file uploads
• Multiple connection resets or aborted requests to file upload endpoints in web server logs

Detection Strategies

• Monitor disk space utilization on servers running Fastify applications with file upload functionality
• Implement alerting for rapid growth in temporary directory sizes
• Analyze web server logs for patterns of repeated, incomplete multipart upload requests from the same source
• Track and alert on high volumes of connection resets to upload endpoints

Monitoring Recommendations

• Set up filesystem monitoring to alert when temporary directories exceed normal thresholds
• Implement log analysis rules to detect patterns of repeated canceled upload requests
• Monitor network traffic for unusually high volumes of partial POST requests to multipart endpoints
• Deploy automated cleanup scripts to periodically remove stale temporary files as a secondary defense

How to Mitigate CVE-2025-24033

Immediate Actions Required

• Upgrade @fastify/multipart to version 8.3.1 or later for 8.x installations
• Upgrade @fastify/multipart to version 9.0.3 or later for 9.x installations
• Audit application code to identify all endpoints using the saveRequestFiles function
• Implement disk space monitoring and alerts on affected servers
• Review and clean up any accumulated temporary files in upload directories

Patch Information

The vulnerability has been addressed in @fastify/multipart versions 8.3.1 and 9.0.3. The patches modify the saveRequestFiles function to properly register cleanup handlers for request cancellation events, ensuring temporary files are deleted regardless of how the request terminates.

For detailed information about the fix, see the GitHub Pull Request and the GitHub Security Advisory GHSA-27c6-mcxv-x3fh.

Workarounds

• Avoid using the saveRequestFiles function until the patched version can be deployed
• Implement custom file upload handling that includes explicit cleanup on request abort events
• Set up a cron job or scheduled task to periodically clean up orphaned temporary files
• Implement rate limiting on file upload endpoints to slow down potential exploitation attempts
• Configure filesystem quotas on temporary directories to limit maximum disk space consumption

# Example cron job to clean up orphaned temp files older than 1 hour
# Add to crontab with: crontab -e
0 * * * * find /tmp/fastify-multipart-* -type f -mmin +60 -delete 2>/dev/null

# Alternative: Set up disk space monitoring alert
df -h /tmp | awk 'NR==2 {if ($5+0 > 80) print "WARNING: Temp directory usage at "$5}'