7.5
CVE-2025-24033
- EPSS 0.57%
- Veröffentlicht 23.01.2025 18:15:33
- Zuletzt bearbeitet 15.04.2026 00:35:42
- CVE-Watchlists
- Unerledigt
@fastify/multipart vulnerable to unlimited consumption of resources
@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Herstellerfastify
≫
Produkt
fastify-multipart
Version
< 8.3.1
Status
affected
Version
>= 9.0.0, < 9.0.3
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.57% | 0.446 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| security-advisories@github.com | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
CWE-770 Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
https://github.com/fastify/fastify-multipart/issues/546
https://github.com/fastify/fastify-multipart/pull/567
https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fh