GitHub Advisoryadvisory · npm

GHSA-hpp2-2cr5-pf6g Denial of service due to unlimited number of parts

HIGH Published 2023-02-14 Modified 2023-02-14 Official page ↗
Aliases
CVE-2023-25576
Ecosystem
npm
Packages
@fastify/multipart
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2023-02-14

Affected packages

• npm @fastify/multipart: < 6.0.1 → fixed in 6.0.1 • npm @fastify/multipart: >= 7.0.0, < 7.4.1 → fixed in 7.4.1

Description

Impact • The multipart body parser accepts an unlimited number of file parts. • The multipart body parser accepts an unlimited number of field parts. • The multipart body parser accepts an unlimited number of empty parts as field parts. Patches This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). Workarounds There are no known workaround. References Reported at https://hackerone.com/reports/1816195.

Related

Alias · CVE (1)

  • CVE-2023-25576 @fastify/multipart is a Fastify plugin to parse the multipart content-type. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References