CVE-2023-25576 HIGH

CVE-2023-25576: @fastify/multipart vulnerable to DoS due to unlimited number of parts

Vendor Fastify
Product fastify-multipart
Weakness CWE-770 · Uncontrolled resource consumption
Published February 14, 2023
Last update March 10, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.

Key dates

02Disclosure timeline

February 14, 2023 CVE published
March 10, 2025 Record updated