@fastify/multipart CVE debriefs

CVE-2026-19474

The @fastify/multipart package, a multipart form-data parser for Fastify, has a vulnerability in versions from 3.0.0 up to but not including 10.1.1. This issue arises when request.saveRequestFiles() leaves completed temporary files on disk if a client disconnects while the parser is processing multipart parts. The iterator rejection between parts does not trigger the per-file cleanup, resulting in persist [truncated]