CVE-2026-66730: facil.io Denial-of-Service Vulnerability

CVE-2026-66730 Overview

CVE-2026-66730 is an infinite loop denial-of-service vulnerability in the facil.io C web application framework, affecting versions 0.6.0 through 0.7.6. The flaw resides in the multipart body parser used to process multipart/form-data HTTP requests. An unauthenticated remote attacker can send a crafted request containing a partial closing boundary that causes worker processes to spin at 100% CPU indefinitely. The parser function http_mime_parse returns 0 bytes consumed without setting either the done or error flag, so the calling loop re-invokes it on the same buffer forever. Repeated requests exhaust every worker and permanently disable the server until it is manually restarted. This issue is tracked under CWE-835: Loop with Unreachable Exit Condition.

Critical Impact
A single unauthenticated HTTP request can permanently freeze all facil.io worker processes at 100% CPU, taking the server offline until a manual restart.

Affected Products

facil.io 0.6.0 through 0.7.6
Applications embedding the vulnerable facil.io HTTP stack
Services that accept multipart/form-data uploads via facil.io

Discovery Timeline

2026-07-27 - CVE-2026-66730 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-66730

Vulnerability Analysis

The vulnerability affects facil.io, a C-based high-performance web application framework. The multipart MIME parser is responsible for iterating over multipart/form-data bodies and extracting individual parts delimited by boundary markers. The parser is invoked in a loop that continues until it signals completion, encounters an error, or consumes all available bytes. When the parser encounters an input that ends with a partial closing boundary — for example, a boundary sequence truncated before the terminating characters — it cannot determine whether more data will arrive, so it returns without advancing the buffer offset. Because no progress guard is enforced by the caller, the loop invokes the parser again on the same unchanged buffer, yielding the same zero-byte result and repeating forever. See the VulnCheck Security Advisory for the vendor writeup and the GitHub PoC Repository for reproduction details.

Root Cause

The root cause is a missing progress guard in the parser loop. The function http_mime_parse returns 0 bytes consumed on a partial boundary without setting the done or error flags. The calling loop treats this ambiguous return as a request for more data on the same buffer and re-enters the parser without any additional input. This condition matches CWE-835 precisely: a loop whose exit condition can never be satisfied given attacker-controlled input.

Attack Vector

Exploitation requires only network access to the HTTP endpoint. The attacker sends a single multipart/form-data POST request whose body terminates with a truncated closing boundary. Because facil.io uses a pre-forked worker model, each such request locks one worker at 100% CPU. Sending as many requests as there are workers takes the entire server offline. No authentication, user interaction, or elevated privileges are required.

The vulnerability is described in prose only; refer to the linked proof-of-concept for exact byte-level reproduction. See the Infinite Loop DoS PoC repository for the technical details.

Detection Methods for CVE-2026-66730

Indicators of Compromise

Worker processes belonging to a facil.io-based service pinned at 100% CPU with no corresponding request throughput.
HTTP access logs showing multipart/form-data POST requests immediately preceding worker unresponsiveness.
Sudden and permanent loss of request-handling capacity that persists until the process is restarted.
Requests where the body length is shorter than expected relative to the declared boundary structure.

Detection Strategies

Instrument the HTTP layer to log any request whose parsing does not complete within a bounded number of parser iterations.
Add runtime CPU-time watchdogs per worker and alert when a single request thread exceeds a defined budget.
Inspect multipart/form-data bodies at the reverse proxy for truncated closing boundaries before forwarding upstream.

Monitoring Recommendations

Monitor per-process CPU utilization for facil.io workers and alert on sustained 100% usage.
Track worker restart counts and request queue depth as early signals of parser lockup.
Correlate spikes in multipart/form-data request rates from single source IPs with worker saturation events.

How to Mitigate CVE-2026-66730

Immediate Actions Required

Inventory all services that link against or embed facil.io versions 0.6.0 through 0.7.6.
Place a reverse proxy or WAF in front of exposed endpoints and reject malformed multipart/form-data bodies.
Enforce request body size limits and connection timeouts to reduce the blast radius of a lockup.
Configure process supervisors to auto-restart workers that exceed a CPU-time threshold on a single request.

Patch Information

No vendor patch is referenced in the NVD record at the time of publication. Consult the VulnCheck Security Advisory and the upstream facil.io repository for updates. Until an official fix is available, apply the compensating controls below.

Workarounds

Terminate multipart/form-data parsing at an upstream proxy such as NGINX or HAProxy that validates full boundary termination.
Disable multipart/form-data handling on endpoints that do not require file uploads.
Apply a local patch that enforces a progress guard: if http_mime_parse returns 0 bytes without done or error, treat the request as malformed and close the connection.
Rate-limit POST requests carrying multipart/form-data content types to slow exploitation attempts.

bash

# Example NGINX guard: cap request body size and read timeout in front of facil.io
client_max_body_size 8m;
client_body_timeout 5s;
client_body_buffer_size 128k;
# Reject requests that stall mid-body before boundary termination
proxy_read_timeout 10s;
proxy_send_timeout 10s;