CVE-2026-19474 @fastify/multipart CVE debrief

Who should care

Users of Fastify-Multipart, especially those using versions between 3.0.0 and 10.1.1, should be aware of this denial of service vulnerability and upgrade to version 10.1.1 or later to mitigate the risk.

Technical summary

The @fastify/multipart package, a multipart form-data parser for Fastify, has a vulnerability in versions from 3.0.0 up to but not including 10.1.1. The issue occurs when request.saveRequestFiles() leaves completed temporary files on disk if a client disconnects while the parser is processing multipart parts. This happens because the iterator rejection between parts does not trigger the per-file cleanup, resulting in persistent, linear disk consumption that can lead to denial of service. An unauthenticated client can exploit this to cause continuous disk usage. The vulnerability is addressed in @fastify/multipart version 10.1.1.

Defensive priority

CVE-2026-19474 is rated HIGH with a CVSS score of 7.5, indicating a significant risk of denial of service through persistent disk consumption. Upgrade to @fastify/multipart 10.1.1 to mitigate this vulnerability.

Recommended defensive actions

• Upgrade to @fastify/multipart version 10.1.1 or later
• Review and update affected Fastify-Multipart installations
• Monitor for and mitigate potential denial of service attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The issue arises from @fastify/multipart versions 3.0.0 up to but not including 10.1.1, where request.saveRequestFiles() can leave temporary files on disk when a client disconnects during multipart part processing. This results in linear disk consumption, leading to denial of service. The fix is in @fastify/multipart 10.1.1.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.