GHSA-hpp2-2cr5-pf6g
Denial of service due to unlimited number of parts
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/multipart | < 6.0.1 | 6.0.1 |
| npm | @fastify/multipart | >= 7.0.0, < 7.4.1 | 7.4.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
* The multipart body parser accepts an unlimited number of file parts.
* The multipart body parser accepts an unlimited number of field parts.
* The multipart body parser accepts an unlimited number of empty parts as field
parts.
### Patches
This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x).
### Workarounds
There are no known workaround.
### References
Reported at https://hackerone.com/reports/1816195.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g
- https://nvd.nist.gov/vuln/detail/CVE-2023-25576
- https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297
- https://hackerone.com/reports/1816195
- https://github.com/fastify/fastify-multipart
- https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1
- https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1