Fastify/busboy DoS via oversized multipart boundary

Fastify/busboy DoS via oversized multipart boundary fastify / busboy Public Uh oh! There was an error while loading.

This SecurityIncident is relevant to the technology intelligence record because it involves DeveloperTools activity. The source article should remain the factual reference for follow-up coverage.

• fastify / busboy Public Uh oh!
• There was an error while loading.
• Notifications You must be signed in to change notification settings Fork 31 Star 139 @fastify/busboy vulnerable to Denial of Service via oversized multipart boundary High mcollina published GHSA-xjh9-v7x6-24jw Aug 12, 2026 Package @fastify/busboy ( npm ) Affected versions >= 3.1.0, < 3.2.1 Patched versions 3.2.1 Description Impact Versions of @fastify/busboy from 3.1.0 and prior to 3.2.1 are vulnerable to a Denial of Service.
• The vendored streaming multipart search stores its default skip distance in a Uint8Array(256) .
• A multipart boundary of exactly 252 bytes makes the search needle 256 bytes, and the table entry wraps to zero, so a crafted request keeps the search in a CPU-bound loop and stalls the Node.js event loop.
• An unauthenticated client can trigger this with a single small request.