Vulnerability Description
@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Fastify | Fastify-Multipart | < 6.0.1 |
Related Weaknesses (CWE)
References
- https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fbPatchThird Party Advisory
- https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1Release NotesThird Party Advisory
- https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1Release NotesThird Party Advisory
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-Third Party Advisory
- https://hackerone.com/reports/1816195Permissions RequiredThird Party Advisory
- https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fbPatchThird Party Advisory
- https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1Release NotesThird Party Advisory
- https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1Release NotesThird Party Advisory
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-Third Party Advisory
- https://hackerone.com/reports/1816195Permissions RequiredThird Party Advisory
FAQ
What is CVE-2023-25576?
CVE-2023-25576 is a vulnerability with a CVSS score of 7.5 (HIGH). @fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in whic...
How severe is CVE-2023-25576?
CVE-2023-25576 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-25576?
Check the references section above for vendor advisories and patch information. Affected products include: Fastify Fastify-Multipart.