https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T03:45:15.744667+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-165004 EUVD-2026-165004 2026-10-18T03:45:15.747359+00:00 EUVD-2026-165004 https://cve.radiocsirt.org/vuln/fkie_cve-2021-23597 fkie_cve-2021-23597 2026-10-18T03:45:15.747393+00:00

This affects the package fastify-multipart before 5.3.1. By providing a name=constructor property it is still possible to crash the application. **Note:** This is a bypass of CVE-2020-8136 (https://security.snyk.io/vuln/SNYK-JS-FASTIFYMULTIPART-1290382).

 https://cve.radiocsirt.org/vuln/ghsa-qh73-qc3p-rjv2 GHSA-qh73-qc3p-rjv2 — Uncaught Exception in fastify-multipart 2026-10-18T03:45:15.747425+00:00

Affected: npm: fastify-multipart

### Impact

This is a bypass of CVE-2020-8136 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8136). By providing a `name=constructor` property it is still possible to crash the application. The original fix only checks for the key `__proto__` (https://github.com/fastify/fastify-multipart/pull/116).

All users are recommended to upgrade

### Patches

v5.3.1 includes a patch ### Workarounds

No workarounds are possible.

### References

Read up https://www.fastify.io/docs/latest/Guides/Prototype-Poisoning/

### For more information If you have any questions or comments about this advisory: * Open an issue in [https://github.com/fastify/fastify-multipart](https://github.com/fastify/fastify-multipart) * Email us at [hello@matteocollina.com](mailto:hello@matteocollina.com)

 https://cve.radiocsirt.org/vuln/gsd-2021-23597 gsd-2021-23597 2026-10-18T03:45:15.747458+00:00 gsd-2021-23597