Skip to content
OpenAdvisories

Vendor

@fastify/busboy

3 known vulnerabilities.

Products

@fastify/busboy 3
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.8
    CVE-2026-74866

    @fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

    @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a lin…

    @fastify/busboy @fastify/busboy @fastify/busboy npm