CVE-2026-74866 @fastify/busboy CVE debrief

Who should care

Developers using @fastify/busboy in their applications, particularly those handling file uploads or sensitive data, should be aware of the vulnerability and take necessary precautions to prevent header injection attacks. This includes upgrading to version 3.2.2 or later and reviewing and updating consumers such as @fastify/multipart to ensure they are using the patched version of @fastify/busboy. Additionally, developers should monitor for and handle potential header injection attacks. Affected product deployments should be identified and assigned an owner for follow-up. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. Relevant monitoring, detection, and logs should be checked for exposed assets that need extra review. Exceptions should be tracked, and remediated assets should be retested and closed only after evidence is documented. Asset inventory and source tracking can help with this process. Rollback/change windows may be necessary for some systems. Exposure review and vendor patch guidance can help prioritize and plan remediation efforts. Security teams should be aware of the vulnerability and its potential impact on their systems and applications. Vulnerability management processes should be updated to include this vulnerability and its associated risks. This may involve updating incident response plans and procedures to address potential header injection attacks. By taking these steps, developers and security teams can help prevent header injection attacks and protect their systems and applications from potential exploitation. The vulnerability has a CVSS score of 5.8 and a severity of MEDIUM, indicating a moderate level of risk. However, the actual risk may vary depending on the specific use case and deployment of @fastify/busboy. Therefore, it is essential to carefully assess the vulnerability and its potential impact on specific systems and applications. This assessment should be based on the technical details of the vulnerability, as well as the specific security controls and mitigations in place. By doing so, developers and security teams can make informed decisions about how to prioritize and

Technical summary

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. This can lead to filesystem filename pollution, log forging, or header injection when values are forwarded to carriage-return-sensitive sinks. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed.

Defensive priority

Upgrade to @fastify/busboy version 3.2.2 or later to prevent header injection attacks.

Recommended defensive actions

• Upgrade to @fastify/busboy version 3.2.2 or later
• Review and update consumers such as @fastify/multipart to ensure they are using the patched version of @fastify/busboy
• Monitor for and handle potential header injection attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The @fastify/busboy multipart form-data parser for Node.js splits header lines only on the two-byte carriage-return line-feed sequence, allowing lone carriage returns or line feeds in part headers to be carried verbatim into parsed Content-Disposition filename and field names. This can lead to filesystem filename pollution, log forging, or header injection when values are forwarded to carriage-return-sensitive sinks.

Official resources