CVE-2026-19481: Fastify Busboy Parser DoS Vulnerability

CVE-2026-19481 Overview

CVE-2026-19481 is a denial-of-service vulnerability in @fastify/busboy, a widely used multipart form-data parser for Node.js. Versions 1.0.0 through 3.2.0 are affected. An unauthenticated attacker who can submit multipart form-data can crash the parser by sending a part header whose name matches a prototype-inherited property such as __proto__ or constructor. When the application uses direct write or end calls rather than pipe, the resulting TypeError is thrown synchronously and can terminate the Node.js process. The maintainers fixed the issue in @fastify/busboy 3.2.1 by creating the header object with a null prototype.

Critical Impact
An unauthenticated remote attacker can crash a Node.js process that parses multipart uploads with @fastify/busboy, producing a full application denial of service.

Affected Products

@fastify/busboy versions 1.0.0 through 3.2.0
Node.js applications directly consuming @fastify/busboy via write or end
Downstream frameworks and services bundling vulnerable @fastify/busboy releases

Discovery Timeline

2026-08-13 - CVE-2026-19481 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19481

Vulnerability Analysis

The defect is an improper check for an unusual or exceptional condition [CWE-754] in the internal header parser of @fastify/busboy. Headers parsed from a multipart part are stored in a plain JavaScript object. The parser then assumes each looked-up value is an array and calls array methods on it. When an attacker sends a header whose name collides with a prototype-inherited property such as __proto__, constructor, or hasOwnProperty, the property lookup resolves to an inherited value from Object.prototype rather than undefined. That inherited value is truthy but not an array, so the subsequent operation throws a TypeError.

In integrations that rely on stream.pipe, the exception surfaces as an error event and can be handled. In applications that feed data directly using parser.write() or parser.end(), the exception propagates synchronously up the call stack. Unhandled exceptions in Node.js terminate the process, producing an unauthenticated denial-of-service condition against any upload endpoint reachable over the network.

Root Cause

The root cause is the use of a plain object literal ({}) as the backing store for parsed headers. Plain objects inherit from Object.prototype, so property lookups for names such as __proto__ or constructor return inherited members instead of undefined. The fix in version 3.2.1 creates the header container with Object.create(null), giving it no prototype chain and eliminating the ambiguity between attacker-controlled header names and inherited property names.

Attack Vector

Exploitation requires only the ability to submit a multipart form-data request to an endpoint backed by a vulnerable @fastify/busboy version. The attacker crafts a part with a header line whose name equals a prototype-inherited property, for example __proto__: value. No authentication, user interaction, or elevated privileges are required. When the target application processes the parser output through synchronous write/end calls, the crash terminates the Node.js worker.

This vulnerability is described in prose only. Refer to the GitHub Security Advisory GHSA-x8mw-p69m-v3mx for the maintainer's technical write-up.

Detection Methods for CVE-2026-19481

Indicators of Compromise

Multipart request bodies containing part headers named __proto__, constructor, prototype, hasOwnProperty, or toString.
Node.js process crashes with TypeError stack traces originating in @fastify/busboy header parsing functions.
Unexpected worker restarts or container respawns correlated with POST or PUT requests to upload endpoints.

Detection Strategies

Inventory Node.js applications and dependency trees for @fastify/busboy versions between 1.0.0 and 3.2.0 using npm ls @fastify/busboy or SBOM analysis.
Add web application firewall or reverse proxy rules that inspect multipart part headers for prototype-inherited property names and block or log matches.
Correlate process-exit events on application hosts with inbound multipart traffic to identify exploitation attempts.

Monitoring Recommendations

Enable structured logging on the Node.js uncaughtException handler and forward the events to a centralized SIEM.
Track HTTP 5xx spikes and Node.js worker restart counts on endpoints that accept file or form uploads.
Monitor package registries and internal repositories for continued installation of vulnerable @fastify/busboy versions.

How to Mitigate CVE-2026-19481

Immediate Actions Required

Upgrade @fastify/busboy to version 3.2.1 or later across all Node.js applications and container images.
Rebuild and redeploy any service that transitively bundles the vulnerable package, including frameworks that vendor @fastify/busboy.
Add a global uncaughtException handler and process manager (for example pm2 or Kubernetes liveness probes) so that a crashed worker restarts quickly if exploited.

Patch Information

The maintainers released @fastify/busboy 3.2.1, which creates the header container with a null prototype and prevents inherited property lookups from producing non-array truthy values. Details are available in the GitHub Security Advisory GHSA-x8mw-p69m-v3mx and the OpenJS Foundation Security Advisories.

Workarounds

Route multipart data through stream.pipe integrations rather than direct parser.write() or parser.end() calls so that the TypeError surfaces as a handleable error event.
Deploy WAF or ingress filters that reject multipart requests containing part header names matching prototype-inherited properties until the upgrade is complete.
Rate-limit multipart upload endpoints and isolate them behind dedicated workers to contain the blast radius of a successful crash.

bash

# Upgrade @fastify/busboy to the fixed release
npm install @fastify/busboy@3.2.1

# Verify no vulnerable versions remain in the dependency tree
npm ls @fastify/busboy