Most recent entries from all

bdu:2025-00720

EUVD-2026-215284

fkie_cve-2025-24033

@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.

GHSA-27c6-mcxv-x3fh — Unlimited consumption of resources in @fastify/multipart

Affected: npm: @fastify/multipart

### Impact

The `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request.

### Patches

Fixed in version 8.3.1 and 9.0.3

### Workarounds

Do not use `saveRequestFiles`.

### References

This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.