CVE-2026-19484: @fastify/busboy DoS Vulnerability

CVE-2026-19484 Overview

CVE-2026-19484 is a denial of service vulnerability in @fastify/busboy, a multipart form-data parser used across the Node.js ecosystem. Affected versions 3.1.0 through 3.2.0 process attacker-controlled multipart boundaries in a streaming search routine that misbehaves at a specific input length. A remote unauthenticated attacker can send a small multipart request whose boundary is exactly 252 bytes and stall the Node.js event loop. The result is a CPU-bound loop that keeps one core busy and denies service to other requests handled by the same process. The maintainers fixed the issue in @fastify/busboy 3.2.1.

Critical Impact
A single small unauthenticated HTTP request can pin a Node.js worker CPU at 100%, denying service to all other requests handled by the affected process.

Affected Products

@fastify/busboy version 3.1.0
@fastify/busboy versions 3.1.x through 3.2.0
Node.js applications and Fastify services that depend on vulnerable @fastify/busboy releases

Discovery Timeline

2026-08-13 - CVE-2026-19484 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-19484

Vulnerability Analysis

The flaw is an algorithmic complexity issue [CWE-835] in the vendored streaming search implementation used to locate multipart boundaries. The search routine builds a Boyer-Moore-style skip table sized as a fixed 256 entry byte array. When the search needle reaches 256 bytes, the default skip distance is truncated to zero. A boundary of exactly 252 bytes produces a needle of 256 bytes once the required -- prefix and framing bytes are added.

With a zero skip distance, the search cannot advance by more than one byte per iteration. The parser then loops over the request body performing character comparisons without meaningful forward progress. Because Node.js executes JavaScript on a single event loop thread, this loop blocks all other request handlers, timers, and I/O callbacks running in the same process.

Root Cause

The skip table is a fixed 256 entry byte array, which cannot store skip distances greater than 255. When the needle length equals or exceeds 256 bytes, the computed skip distance overflows the byte storage and truncates to zero. The fix in 3.2.1 widens the skip table so the true skip distance is preserved for longer needles.

Attack Vector

Exploitation requires only network access to any endpoint that accepts multipart form-data through @fastify/busboy. The attacker crafts an HTTP request with Content-Type: multipart/form-data; boundary=<252-byte string> and a small body. No authentication, user interaction, or elevated privileges are required. A single request pins one worker thread; repeated requests can exhaust every worker in a cluster.

The vulnerability is described in prose only because no verified proof-of-concept code has been published. Reference the GitHub Security Advisory GHSA-xjh9-v7x6-24jw for the maintainer analysis.

Detection Methods for CVE-2026-19484

Indicators of Compromise

Inbound HTTP requests with Content-Type: multipart/form-data where the boundary parameter is exactly 252 bytes long.
Sustained 100% CPU utilization on a single Node.js worker thread immediately following a small multipart POST.
Node.js event loop lag metrics spiking to seconds while inbound request volume remains low.

Detection Strategies

Inspect HTTP request headers at the proxy or WAF layer and flag multipart/form-data boundaries with lengths at or above 250 bytes.
Correlate application performance monitoring (APM) event loop lag spikes with concurrent multipart request logs to identify the triggering client.
Query dependency inventories and software bill of materials (SBOM) data for @fastify/busboy versions between 3.1.0 and 3.2.0.

Monitoring Recommendations

Alert on process CPU saturation combined with stalled request handlers on Node.js services that accept file uploads.
Track request latency percentiles for multipart endpoints and alert on sudden tail latency degradation.
Log the raw Content-Type header on multipart endpoints so boundary lengths can be audited retroactively.

How to Mitigate CVE-2026-19484

Immediate Actions Required

Upgrade @fastify/busboy to version 3.2.1 in all affected services and redeploy.
Audit transitive dependencies, since packages such as Fastify multipart plugins may pull in @fastify/busboy indirectly.
Rate-limit unauthenticated multipart endpoints and restrict request concurrency per source IP.

Patch Information

The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved for needles of 256 bytes or larger. Update the direct or transitive dependency and verify with npm ls @fastify/busboy that no vulnerable copy remains in the tree. See the GitHub Security Advisory GHSA-xjh9-v7x6-24jw and the OpenJS Foundation Security Advisories for release details.

Workarounds

Reject multipart requests at a reverse proxy or WAF when the boundary parameter length is 250 bytes or greater.
Enforce short request timeouts on multipart handlers so a stalled parser is terminated before starving the event loop.
Run Node.js services behind a process manager configured to restart workers when event loop lag exceeds a threshold.

bash

# Upgrade the vulnerable package to the patched release
npm install @fastify/busboy@3.2.1
npm ls @fastify/busboy