Vulnerability Description
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/fastify/fastify-multipart/issues/546
- https://github.com/fastify/fastify-multipart/pull/567
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-
FAQ
What is CVE-2025-24033?
CVE-2025-24033 is a vulnerability with a CVSS score of 7.5 (HIGH). @fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user...
How severe is CVE-2025-24033?
CVE-2025-24033 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2025-24033?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.