CVE-2026-74866

About vulnerability

Impact

@fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is carried verbatim into the filename and field name delivered by the file and field events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character.

An attacker who uploads a file whose filename or field name contains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using @fastify/busboy directly, or through @fastify/multipart and its consumers, are affected.

Patches

Upgrade to @fastify/busboy 3.2.2 or later.

Workarounds

Validate or strip carriage return and line feed characters from the filename and field name before using them in any filesystem, logging, or outbound-header context.

Affected product:

Fastify , ai , ai-sdk-alibaba , ai-sdk-amazon-bedrock , ai-sdk-angular , ai-sdk-anthropic , ai-sdk-anthropic-aws , ai-sdk-assemblyai , ai-sdk-azure , ai-sdk-baseten , ai-sdk-black-forest-labs , ai-sdk-cerebras , ai-sdk-cohere , ai-sdk-deepgram , ai-sdk-deepinfra , ai-sdk-deepseek , ai-sdk-elevenlabs , ai-sdk-fal , ai-sdk-fireworks , ai-sdk-gateway , ai-sdk-gladia , ai-sdk-gmicloud , ai-sdk-google , ai-sdk-google-vertex , ai-sdk-groq , ai-sdk-harness , ai-sdk-harness-cline , ai-sdk-harness-codex , ai-sdk-harness-cursor , ai-sdk-harness-deepagents , ai-sdk-harness-fx , ai-sdk-harness-pi , ai-sdk-huggingface , ai-sdk-hume , ai-sdk-langchain , ai-sdk-llamaindex , ai-sdk-luma , ai-sdk-mcp , ai-sdk-mistral , ai-sdk-moonshotai , ai-sdk-open-responses , ai-sdk-openai , ai-sdk-openai-compatible , ai-sdk-otel , ai-sdk-perplexity , ai-sdk-policy-opa , ai-sdk-prodia , ai-sdk-provider-utils , ai-sdk-react , ai-sdk-replicate , ai-sdk-revai , ai-sdk-rsc , ai-sdk-sandbox-just-bash , ai-sdk-sandbox-vercel , ai-sdk-svelte , ai-sdk-togetherai , ai-sdk-valibot , ai-sdk-vercel , ai-sdk-vue , ai-sdk-workflow-harness , ai-sdk-xai , ai-sdk-zai , astro , astrojs-cloudflare , astrojs-internal-helpers , astrojs-markdown-remark , astrojs-prism , astrojs-svelte , astrojs-underscore-redirects , browserbasehq-stagehand , chat , chat-adapter-discord , chat-adapter-gchat , chat-adapter-github , chat-adapter-gmail , chat-adapter-instagram , chat-adapter-linear , chat-adapter-messenger , chat-adapter-notion , chat-adapter-shared , chat-adapter-slack , chat-adapter-state-ioredis , chat-adapter-state-memory , chat-adapter-state-pg , chat-adapter-state-redis , chat-adapter-teams , chat-adapter-telegram , chat-adapter-tests , chat-adapter-twilio , chat-adapter-web , chat-adapter-whatsapp , chat-adapter-x , cline , cline-llms , cline-sdk , cline-shared , copilotkit , copilotkit-a2ui-renderer , copilotkit-agentcore-runner , copilotkit-mcp-apps-renderer , copilotkit-react-native , copilotkit-react-textarea , copilotkit-react-ui , copilotkit-runtime , copilotkit-runtime-client-gql , copilotkit-shared , copilotkit-sqlite-runner , copilotkit-voice , copilotkit-vue , copilotkit-web-components , copilotkit-web-inspector , create-sanity , dify-ai-provider , dotansimha-graphql-yoga , firebase , firebase-auth , firebase-functions , firebase-functions-compat , firebase-js-sdk , firebase-storage , firebase-storage-compat , firestore-compat , gateway , graphql-code-generator , graphql-inspector , graphql-inspector-ci , graphql-inspector-git-loader , graphql-inspector-graphql-loader , graphql-inspector-url-loader , graphql-tools , graphql-tools-apollo-engine-loader , graphql-tools-github-loader , graphql-tools-relay-operation-optimizer , graphql-tools-url-loader , graphql-yoga , graphql-yoga-apollo-link , graphql-yoga-plugin-apollo-inline-trace , graphql-yoga-plugin-apq , graphql-yoga-plugin-persisted-operations , graphql-yoga-plugin-sofa , hardhat , mastra , mastra-agent-builder , mastra-code-sdk , mastra-core , mastra-deployer , mastra-factory , mastra-longmemeval , mastracode , mem0-openclaw-mem0 , mem0ai , miniflare , nitro , nomicfoundation-hardhat-ethers , ollama-ai-provider-v2 , openapi-contrib-openapi-schema-to-json-schema , openapi-typescript , orama-orama , partykit , qdrant-js , qdrant-js-client-rest , safe-global-testing-kit , sanity , sanity-cli , sanity-diff , sanity-mutator , sanity-schema , sanity-template-validator , sanity-types , sanity-util , sanity-vision , semantic-release-npm , sofa-api , toolkit , undici , vechain-sdk-js , vercel , vercel-blob , vercel-elysia , vercel-express , vercel-fastify , vercel-h3 , vercel-hono , vercel-introspection , vercel-koa , vercel-nestjs , vercel-next , vercel-node , vercel-python , vercel-remix-builder , vinxi , whatwg-node , whatwg-node-fetch , workers-sdk , youtubei.js

Affected packages:

@fastify/busboy @ 2.1.1 (+1716 more)