CVE-2026-74866: @fastify/busboy Header Injection Vulnerability

CVE-2026-74866 Overview

CVE-2026-74866 is a CRLF injection vulnerability [CWE-93] in @fastify/busboy, a multipart form-data parser for Node.js. The parser splits part-header lines only on the two-byte carriage-return line-feed (\r\n) sequence. A bare \r or \n embedded in a header is not treated as a line break and is passed verbatim into parsed Content-Dispositionfilename and field name values. Attackers can inject control characters into downstream consumers that trust the parser to return clean values. All versions up to and including 3.2.1 are affected. Version 3.2.2 rejects any header line that still contains a bare carriage return or line feed.

Critical Impact
Attackers who upload files with crafted filenames or field names can trigger filesystem filename pollution, log forging, and header injection in CRLF-sensitive sinks.

Affected Products

@fastify/busboy versions up to and including 3.2.1
@fastify/multipart and other downstream consumers pinned to vulnerable @fastify/busboy versions
Node.js applications that forward parsed multipart filenames or field names to CR/LF-sensitive sinks

Discovery Timeline

2026-08-21 - CVE-2026-74866 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-74866

Vulnerability Analysis

The defect lies in how @fastify/busboy tokenizes multipart part headers. RFC 7578 multipart bodies delimit header lines with \r\n, and the parser's line-splitting logic looks for that two-byte sequence exclusively. When a header value contains only a bare \r (0x0D) or bare \n (0x0A), the parser treats those bytes as ordinary content and preserves them inside the extracted value.

Because Content-Disposition supplies both the name and filename fields, the injected control characters land directly in values the application later uses to build file paths, write log entries, or construct outbound HTTP headers. Consumers that assume the parser returns sanitized strings inherit the injection primitive.

Root Cause

The root cause is incomplete input validation of header line terminators in the multipart part-header parser. The parser accepts \r\n as a delimiter but does not reject or normalize stray \r or \n bytes appearing inside a single header line. This violates the CRLF neutralization expectation described in CWE-93: Improper Neutralization of CRLF Sequences.

Attack Vector

An unauthenticated remote attacker submits a multipart form-data request in which the filename or field name parameter contains an embedded bare \r or \n byte. The parser hands the raw value to the application. When that value reaches a CR/LF-sensitive sink such as fs.writeFile, a line-oriented logger, or an outbound HTTP client, the injected bytes are interpreted as record or header separators. Typical outcomes include forged log lines, split HTTP responses, and files written to attacker-controlled names on disk.

No verified public exploit code is available. See the GitHub Security Advisory GHSA-gxm5-99cw-xjw9 for the maintainers' technical description.

Detection Methods for CVE-2026-74866

Indicators of Compromise

Log entries containing unexpected line breaks inside a filename or field-name value
Files written to disk whose names contain embedded 0x0D or 0x0A bytes
HTTP responses or downstream requests exhibiting header split artifacts after multipart uploads
Access logs showing multipart requests with Content-Disposition headers containing bare CR or LF bytes

Detection Strategies

Inspect raw multipart request bodies at the reverse proxy or WAF for bare \r or \n bytes inside Content-Disposition parameters
Audit application code for uses of busboy field values in fs, logging, and outbound HTTP APIs without sanitization
Run software composition analysis to enumerate direct and transitive dependencies on @fastify/busboy at or below 3.2.1

Monitoring Recommendations

Alert on process telemetry showing file writes with control characters in filenames
Forward web server access logs to a centralized store and query for multipart uploads containing raw control bytes
Track dependency drift so downstream consumers such as @fastify/multipart remain pinned to fixed transitive versions

How to Mitigate CVE-2026-74866

Immediate Actions Required

Upgrade @fastify/busboy to version 3.2.2 or later across all services
Update any consumer package, including @fastify/multipart, to a release that pulls in the fixed @fastify/busboy version
Sanitize any filename or field name value before passing it to filesystem, logging, or HTTP APIs

Patch Information

The fix is available in @fastify/busboy version 3.2.2, which rejects any header line containing a bare carriage return or line feed. Details are published in the GitHub Security Advisory GHSA-gxm5-99cw-xjw9 and the OpenJSF Security Advisories.

Workarounds

Reject multipart requests whose Content-Disposition headers contain bare \r or \n bytes at an upstream proxy or WAF
Normalize or strip control characters from filename and field name values before consuming them in application code
Constrain uploaded filenames to a strict allow-list character set before using them for filesystem operations

bash

# Upgrade the vulnerable dependency
npm install @fastify/busboy@3.2.2

# Verify no transitive vulnerable versions remain
npm ls @fastify/busboy