CVE-2026-74866
Description
A flaw was found in @fastify/busboy, a Node.js multipart form-data parser. The parser incorrectly handles lone carriage return or line feed characters in multipart part headers, treating them as part of the filename or field name rather than as line breaks. A remote attacker could exploit this by uploading a file with a specially crafted filename or field name, leading to control character injection. This could result in filesystem filename pollution, log forging, or header injection in applications that process these values.
Statement
A flaw was found in @fastify/busboy. The library does not sanitize CRLF sequences in multipart Content-Disposition filename and name fields. An attacker can inject CRLF characters into multipart form data, which may be passed through to downstream HTTP responses or headers if the application reflects the parsed filename or name values without additional sanitization, potentially enabling HTTP response splitting or header injection.
Mitigation
Applications using @fastify/busboy should sanitize any multipart Content-Disposition filename and name values before reflecting them in HTTP responses or headers. Strip or reject any input containing CR (0x0D) or LF (0x0A) characters in parsed multipart field names and filenames.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.8 | N/A | 5.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
