CVE-2026-18549

METADATA VENDOR_NAME: Fastify AFFECTED_VERSION: >= 5.3.0, < 10.1.1 MITRE_TACTIC: T1499 — Endpoint Denial of Service SHODAN_DORKS: ["x-powered-by: Fastify", "http.component: Fastify", "Fastify multipart/form-data"] CWE_ID: CWE-400 CVSS_VECTOR: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H POC_STATUS: None PATCH_DETAILS: Upgrade to @fastify/multipart 10.1.1 (stated fixed version in NVD description). Tracked patch confidence is 0/4 — no independently confirmed patch source observed.

Executive Summary

CVE-2026-18549 is a high-severity (CVSS 7.5) denial-of-service vulnerability in @fastify/multipart, the standard multipart form-data parser for the Fastify Node.js web framework, affecting versions 5.3.0 up to but not including 10.1.1. When the busboy fileSize limit truncates a file part, the parser clears its internal current-file reference while the underlying stream is still open; if the client then aborts the connection before the terminating boundary, saveRequestFiles() never settles, the request handler hangs, and the partially written temporary file is never removed. An unauthenticated attacker can repeat this cycle to exhaust disk space and the Node.js event loop, taking affected file-upload endpoints out of service.

Technical Analysis

@fastify/multipart is the officially maintained multipart/form-data parser for Fastify, a widely deployed Node.js web framework. It is used on routes that accept file uploads and manages the streaming of multipart parts via the busboy parser. The vulnerability is a state-management flaw: the plugin mishandles the lifecycle of its internal current-file reference when a part is truncated by the busboy fileSize limit, breaking the abort-cleanup path and leaving a dangling suspended handler plus an orphaned temporary file.

The mechanism can be broken down as follows:

1. The client sends a multipart/form-data request containing a file part that exceeds the configured busboy fileSize limit.
2. busboy truncates the file part at the configured limit. On truncation, the plugin clears its internal current-file reference. The underlying file stream, however, is never closed — it remains open.
3. The client aborts the TCP connection before sending the terminating multipart boundary.
4. The abort-cleanup routine attempts to destroy the currently referenced stream. Because the current-file reference was already cleared, there is no stream to destroy; the cleanup path no-ops.
5. With no stream to destroy and no terminating boundary ever processed, the saveRequestFiles() promise never settles — it neither resolves nor rejects. The request handler remains suspended indefinitely, and the temporary file already written to the temp directory is never unlinked by the framework.

Each attempt permanently consumes two categories of resources: one suspended handler execution (tying up the event loop) and one orphaned temporary file on disk. The event-loop exhaustion behaves like a slow, incremental denial of service — the Node.js process becomes progressively less responsive and eventually cannot service new requests. The disk exhaustion is durable: leaked temp files persist across application restarts, because a restart frees the event loop but does not delete orphaned files.

Attack surface and reachability: the vulnerable code path exists in all versions from 5.3.0 up to but not including 10.1.1. Any publicly reachable Fastify route that invokes multipart parsing with a fileSize limit configured is exposed. The vulnerability requires no authentication, no privileges, and no user interaction; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a purely availability impact with no confidentiality or integrity consequence.

Patch confidence note: the tracked patch confidence for this advisory is 0/4 — no patch evidence from any tracked source — which conflicts with the NVD description's explicit statement that the issue is fixed in @fastify/multipart 10.1.1. Until independent patch confirmation is available, treat the upgrade to 10.1.1 as the authoritative remediation and combine it with compensating controls described later in this report.

Exploitation Scenarios

No public PoC or exploit code has been identified for CVE-2026-18549; the attack chain below is inferred strictly from the NVD description and the vulnerability class (uncontrolled resource consumption via premature connection abort).

1. Reconnaissance / target identification: the attacker locates Fastify-based web applications exposing multipart upload endpoints. Fingerprinting can be performed via the HTTP response header "x-powered-by: Fastify" when enabled, via distinct Fastify error responses, or simply by identifying endpoints that accept POST requests with multipart/form-data content. No credentials are required at any stage.

2. Flaw trigger: the attacker crafts a multipart/form-data POST request containing a file part whose size exceeds the configured busboy fileSize limit. This causes busboy to truncate the part, which in turn causes the plugin to clear its current-file reference while the underlying stream is still open.

3. Execution at the vulnerability-class level: immediately after the truncation, the attacker aborts the TCP connection before transmitting the terminating multipart boundary. The abort-cleanup logic finds no stream to destroy, the saveRequestFiles() promise never settles, and the request handler hangs. The temporary file already written to disk is never cleaned up.

4. Post-exploitation: the attacker repeats steps 1–3 from one or many source IPs. Accumulation of leaked temp files drives the filesystem toward a full state, while accumulated suspended handler executions progressively block the Node.js event loop. The end result is a complete availability loss of the affected service and, in a shared-hosting or multi-tenant environment, possible collateral impact on co-located processes sharing the same disk or host. Because the leak is not cleaned up by the application, the damage persists even after the application process is restarted.

Impact Assessment

The vulnerability has a CVSS base score of 7.5 (High) with a single subscore of significance: Availability — High (A:H). Confidentiality (C:N) and Integrity (I:N) are unaffected; there is no data exfiltration and no file-content tampering. The attack is exploitable over the network with low complexity, requires no privileges and no user interaction, and does not change the trust boundary (S:U).

Affected systems: every Fastify application using @fastify/multipart in the range >= 5.3.0 and < 10.1.1, specifically on routes where file uploads are accepted and a fileSize limit is configured. This includes API servers, content-management backends, email/file-transfer gateways, and any microservice that consumes multipart uploads.

Business impact: unauthenticated remote denial of service on upload functionality; event-loop exhaustion that degrades or halts the entire Node.js process; disk-full conditions that can crash the application and affect other services writing to the same volume; long operational cleanup burden to remove orphaned temp files. The EPSS score is not yet available from FIRST.org, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog; no known threat actor campaigns or in-the-wild exploitation have been reported at the time of writing.

Detection Guidance

Sigma Rule

title: Fastify Multipart Abort-Based Denial of Service Attempt (CVE-2026-18549)
id: 4f8d2b21-9a3c-4e6d-8f03-1c7a2b9e5d44
status: experimental
description: Detects a high frequency of aborted HTTP POST requests carrying
    multipart/form-data content, matching the connection-abort pattern used to
    exploit CVE-2026-18549 against @fastify/multipart < 10.1.1.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-18549
author: Threat Intelligence Team
date: 2026/06/01
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: POST
        http.content_type|startswith: multipart/form-data
        http.response.status_code: 499
    timeframe: 5m
    condition: selection | count() by http.source.ip > 10
falsepositives:
    - Users on unstable network connections repeatedly retrying large uploads
    - Legitimate upload clients that drop connections on client-side timeout
level: high
tags:
    - attack.t1499
    - cwe.400
    - cve.2026.18549

YARA Rule

rule fastify_multipart_vulnerable_dependency {
    meta:
        description = "Detects package manifests and vendored packages referencing
            @fastify/multipart versions affected by CVE-2026-18549 (>= 5.3.0, < 10.1.1)"
        author = "Threat Intelligence Team"
        date = "2026-06-01"
        cve = "CVE-2026-18549"
        severity = "high"
    strings:
        $pkg_name = "@fastify/multipart"
        $semver = /"@fastify\/multipart"\s*:\s*"[~^<>=\s0-9.*x-]+"/
        $vendored = /node_modules[\/\\]@fastify[\/\\]multipart/
    condition:
        filesize < 2MB and (($pkg_name and $semver) or $vendored)
}

Suricata IDS Rule

# Suricata rule: flags a threshold of multipart POST requests from a single
# source that match the characteristic profile of CVE-2026-18549 exploitation
# (upload-sized multipart POSTs that are aborted or left without a terminating
# boundary). Because the boundary-abort condition is not visible mid-stream,
# this rule uses behavioral threshold detection on the request pattern.
alert http $EXTERNAL_NET any -> $HOME_NET any ( \
    msg:"ET DOS Fastify Multipart fileSize Truncation/Abort Attempt (CVE-2026-18549)"; \
    flow:to_server,established; \
    http.method; content:"POST"; \
    http.content_type; content:"multipart/form-data"; \
    http.header_names; content:"content-length"; \
    threshold:type both, track by_src, count 20, seconds 60; \
    classtype:attempted-dos; \
    sid:1008549; rev:1; \
)

Elastic Detection

// Detects a single source IP performing a high volume of aborted multipart
// POST requests observed as HTTP 499 (client closed request) in web-server
// access logs — the behavioral signature of CVE-2026-18549 exploitation.
sequence by source.ip with maxspan=15m
  [ http where http.request.method == "POST"
      and http.request.content_type == "multipart/form-data"
      and http.response.status_code == 499 ]
  [ http where http.request.method == "POST"
      and http.request.content_type == "multipart/form-data"
      and http.response.status_code == 499 ] with runs = 10

Splunk SPL Query

index=web sourcetype=access_combined_w3c status=499 method=POST
| where like(req_header_content_type, "multipart/form-data%")
| bucket _time span=10m
| stats count as abort_count, dc(_time) as active_minutes by src_ip, uri_path, host
| where abort_count > 20
| sort - abort_count

Wazuh OSSEC Rule

<!--
  Wazuh OSSEC rule: alerts on repeated aborted multipart upload requests,
  a behavioral indicator of CVE-2026-18549 exploitation against
  @fastify/multipart < 10.1.1. Adjust logsource/match strings to fit the
  application's access-log format and the local decoder in use.
-->
<group name="fastify,cve-2026-18549,dos,">
  <rule id="100185" level="12" frequency="10" timeframe="120">
    <if_matched_group>web</if_matched_group>
    <match>client closed connection|multipart/form-data</match>
    <description>Fastify multipart: repeated aborted multipart uploads (CVE-2026-18549 DoS attempt)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

1. Immediate mitigations (if unable to upgrade):

• Upgrade to @fastify/multipart 10.1.1 as stated in the NVD description; this is the only known fix. Note the tracked patch confidence is 0/4 — no patch evidence from any tracked source — so verify the advisory independently after upgrade.
• Enforce request body-size limits at the reverse proxy or load balancer (e.g., nginx client_max_body_size) so oversized multipart bodies are rejected before reaching the Fastify application.
• Enforce strict connection/read timeouts at the proxy layer and in Fastify so aborted or idle upload connections are terminated promptly at the network edge.
• Rate-limit multipart POST requests per source IP at the reverse proxy or WAF.
• Set a filesystem quota on the temporary-file directory used by @fastify/multipart to cap the disk impact of leaked files.
• Deploy a scheduled sweep job that deletes orphaned temporary files older than a threshold from the temp directory.

2. Patch / upgrade steps:

• Run npm install @fastify/multipart@10.1.1 (or bump the dependency to ^10.1.1) in every affected service.
• Verify the installed version with npm ls @fastify/multipart and re-deploy after regression testing the upload endpoints.
• Run npm audit and CI dependency-scanning to confirm no affected version remains in lock files or vendored dependencies.

3. Long-term hardening:

• Add automated vulnerability scanning (OSV, npm audit, SCA tooling) to the CI/CD pipeline so future Fastify-ecosystem issues are caught before production deployment.
• Monitor Node.js event-loop delay, process responsiveness, and temp-directory disk usage with alerting thresholds.
• Maintain WAF rules that reject multipart bodies that do not contain a properly terminated terminating boundary.
• Add negative tests to the upload test suite that exercise truncated uploads and client aborts to verify new releases do not reintroduce the hang/leak behavior.

References

• NVD entry for CVE-2026-18549: https://nvd.nist.gov/vuln/detail/CVE-2026-18549
• Official source repository for @fastify/multipart: https://github.com/fastify/fastify-multipart
• npm package registry page for @fastify/multipart: https://www.npmjs.com/package/@fastify/multipart
• CWE-400 Uncontrolled Resource Consumption: https://cwe.mitre.org/data/definitions/400.html
• No CISA KEV listing applies; no known in-the-wild exploitation, exploit code, or threat-actor campaign has been reported for this CVE at the time of writing. EPSS has not yet been scored by FIRST.org.