CVE-2026-19474

Executive Summary

CVE-2026-19474 is a high-severity (CVSS 7.5) denial-of-service vulnerability in the @fastify/multipart parser for Fastify, affecting versions 3.0.0 up to but not including 10.1.1. When a Fastify application uses request.saveRequestFiles() to persist uploaded parts, an unauthenticated remote client can disconnect while the parser is advancing between multipart parts, causing completed temporary files to remain orphaned on disk indefinitely. Repeated exploitation results in persistent, linear disk consumption and filesystem exhaustion, leading to denial of service. The issue is an incomplete-fix variant of CVE-2025-24033 and is remediated in @fastify/multipart 10.1.1.

Technical Analysis

The vulnerability is a resource-management defect in the multipart parsing lifecycle of @fastify/multipart, classified under CWE-459 (Incomplete Cleanup). In affected versions, the API request.saveRequestFiles() provides applications a convenience method to persist incoming multipart file parts to temporary storage. The parser consumes the multipart message as an asynchronous stream, advancing part-by-part across boundary-delimited sections, writing each completed part's payload to a temporary file as it goes.

The cleanup logic is scoped to the processing of an individual part: if an error occurs while a given part is being written, the corresponding temporary file is removed. However, the failure handling does not cover the case where the underlying request stream rejects between parts — for example, when the client terminates the TCP connection while the parser is awaiting the next chunk or boundary. In that window, the iterator itself rejects, and the rejection propagates outside the per-file cleanup path. A file that was already fully written for an earlier, completed part is therefore never unlinked. No compensating sweep is performed, and the orphaned file persists for the lifetime of the filesystem.

The attack surface is any Fastify instance that (a) exposes a network-accessible endpoint accepting multipart/form-data and (b) invokes request.saveRequestFiles() to persist uploaded content. Because the CVSS vector indicates PR:N (no privileges required) and AV:N (network attack vector), the endpoint does not need to be authenticated. The amplification factor is linear: each crafted request that completes at least one file part and then forces an inter-part disconnect leaves one or more files on disk. Over time, the accumulation consumes available filesystem space until write operations fail system-wide.

This advisory explicitly characterizes CVE-2026-19474 as an incomplete-fix variant of CVE-2025-24033. A prior remediation addressed a related temp-file cleanup gap, but the inter-part iterator rejection path remained uncovered, demonstrating that partial fixes to multipart cleanup logic are insufficient without unifying cleanup at the request-iterator level. Insufficient technical detail is available in the public record to describe internal function names beyond request.saveRequestFiles(); the analysis above is derived strictly from the NVD description and the vulnerability class.

Exploitation Scenarios

No public proof-of-concept or exploit code is available in tracked sources as of this report. The attack chain below is inferred from the vulnerability class and the NVD description; it should be treated as an analytical model, not a confirmed exploit walkthrough.

1. Reconnaissance / target identification. The attacker identifies Fastify-based web applications or APIs that accept multipart uploads. Usable signals include HTTP response headers identifying Fastify, error-page formatting, or behavioral fingerprinting of multipart endpoints (e.g., upload pages for avatars, attachments, documents, or data ingestion). Shodan-style exposure dorks for "Fastify" or multipart-capable services assist in discovering reachable instances. The attacker has no need for credentials or user accounts.

2. Triggering the flaw. The attacker opens a direct connection to the multipart endpoint and submits a POST request whose body is a valid multipart/form-data message containing at least one complete file part. At the precise transition point — after the first part has been fully written to a temporary file, while the server is awaiting the next boundary sequence — the attacker terminates the connection (e.g., sends a TCP RST or simply closes the socket). The parser's inter-part iterator rejection occurs and the per-part cleanup handler is never reached for the already-completed file.

3. Payload / execution method. There is no code execution or injection component; the "payload" is purely a resource-exhaustion primitive. A single request can be sufficient to leave one orphaned file, but the practical impact is achieved by repetition: an automated script loops the partial-upload/disconnect sequence thousands of times, each iteration contributing one or more permanent files to the filesystem. Because no authentication is required, the attacker can scale the attack freely across the public network.

4. Post-exploitation impact. The filesystem hosting the temporary directory fills. The target application's write paths fail (ENOSPC-class errors), multipart processing halts for all users, and ancillary services that depend on the same filesystem — log rotation, database transactions, other co-located applications — degrade or crash. In containerized or shared-hosting environments, the blast radius can extend beyond the single Fastify process. The attack is low-cost, high-repeatability, and leaves no obvious trace beyond anomalous connection behavior and disk growth.

Impact Assessment

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H places this at 7.5 (High). The subscores indicate a purely availability-oriented impact: confidentiality and integrity are rated N because the attacker does not read or modify target data through this flaw. The high availability value reflects the denial-of-service outcome — filesystem exhaustion makes the entire application (and potentially co-located services on the host) unavailable.

Business impact depends on exposure: any internet-facing Fastify service that uses request.saveRequestFiles() on a multipart endpoint is at risk. Upload-heavy applications (document portals, API gateways, collaboration tools) are the most exposed. Because the orphaned files persist indefinitely, the operational impact is not self-healing — files accumulate until an administrator manually cleans the temporary directory or reboots/restores the filesystem. There is also a residual data-handling consideration: uploaded content that should have been transient remains at rest on disk beyond its intended lifecycle, which may conflict with data-retention or compliance requirements, although the attacker does not control the contents of other users' files.

The absence of authentication requirements, the low attack complexity, and the lack of a required user interaction make this a practical target for botnet-driven or scripted denial-of-service campaigns. At the time of writing, there is no evidence of exploitation in the wild and no CISA KEV listing, but the vulnerability class is well understood and weaponization is straightforward.

Detection Guidance

The vulnerability leaves no payload signature on the wire. Detection must therefore rely on behavioral signals: anomalous volumes of multipart POST requests from a single source followed by abnormal terminations, incomplete HTTP transactions, and filesystem pressure. The rules below are realistic starting points; log field names and error strings vary by application and logging configuration and should be tuned to local evidence.

Sigma Rule

title: Fastify Multipart Repeated Aborted Uploads - Temp File Leak DoS (CVE-2026-19474)
id: 9f1b2f6c-4a2d-4f9b-9c0a-7a3d9e1f5b2c
status: experimental
description: Detects a high frequency of multipart/form-data POST requests resulting in abnormal HTTP termination from a single source IP, consistent with an unauthenticated attacker repeatedly disconnecting during multipart parsing to trigger orphaned temporary-file accumulation.
author: Valtersit Threat Intelligence
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19474
logsource:
    category: webserver
    definition: Access logs from a reverse proxy or web server fronting a Fastify application. Requires HTTP method, status code, and client IP fields.
detection:
    selection:
        cs-method: POST
        sc-status:
            - 400
            - 408
            - 499
            - 0
    condition: selection | count() by src_ip, cs-host > 100
fields:
    - src_ip
    - cs-host
    - cs-uri-stem
    - sc-status
falsepositives:
    - Clients with unstable network connections retrying large uploads
    - Upload libraries that intentionally cancel in-progress transfers
level: medium

YARA Rule

rule CVE_2026_19474_fastify_multipart_orphan_tmp
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Triages candidate files for residual multipart form-data part headers. A file containing a complete file-part header but lacking a terminating multipart boundary is a candidate orphaned temporary upload from CVE-2026-19474."
        cve = "CVE-2026-19474"
        cwe = "CWE-459"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19474"
        date = "2026-01-01"

    strings:
        $part_header = "Content-Disposition: form-data; name=" ascii wide
        $filename = "filename=" ascii wide
        $ct_any = /Content-Type:\s*\S+/ ascii
        $dash_boundary = "--" ascii
        $term_boundary = /--[a-zA-Z0-9]{8,}--\s*$/ ascii

    condition:
        filesize > 200 and filesize < 104857600
        and $part_header
        and $filename
        and $ct_any
        and not $term_boundary
        and #dash_boundary > 1
}

Suricata IDS Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-19474 Fastify Multipart Aborted Upload Temp File Leak DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data"; http.request_body; content:"Content-Disposition|3a 20|form-data|3b|"; threshold: type both, track by_src_ip, count 100, seconds 60; classtype:attempted-dos; reference:cve,2026-19474; sid:202619474; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=10m
  [ http where http.request.method == "POST" and startsWith(http.request.content_type, "multipart/form-data") ]
  [ http where event.outcome in ("failure", "timeout") or http.response.status_code == 408 or http.response.status_code == 0 ]

Tune the analysis window and add a minimum threshold on repeated sequences per source IP to reduce false positives. For hosts with fastify application logs indexing, correlate the presence of inter-part abort log lines with the HTTP sequence above.

Splunk SPL Query

index=web sourcetype=access_combined method=POST
| where like(_raw, "%multipart/form-data%")
| eval abort=if(status>=400 OR isnull(status) OR status=0, 1, 0)
| stats sum(abort) as aborted_uploads, count(eval(abort=0)) as ok_uploads, dc(uri) as endpoints by src_ip
| where aborted_uploads > 50 AND aborted_uploads > ok_uploads
| sort - aborted_uploads

Supplementary filesystem-pressure query for detecting the downstream effect:

index=os sourcetype=df host=* 
| eval pct_used = (used_bytes / total_bytes) * 100
| stats max(pct_used) as max_pct by host, mount_point
| where max_pct > 90

Wazuh OSSEC Rule

<group name="fastify,multipart,web,">
  <rule id="191474" level="10" frequency="30" timeframe="120">
    <match>ECONNRESET|EPIPE|client connection closed|request aborted</match>
    <regex>multipart|upload|saveRequestFiles</regex>
    <description>CVE-2026-19474: repeated client aborts during multipart upload parsing - possible unauthenticated temp file leak / disk exhaustion DoS.</description>
    <group>dos,attack,</group>
  </rule>
</group>

Note: the error strings above are illustrative of common Fastify/Node.js log output; adapt the <match> and <regex> patterns to the actual application logging format before deployment.

Mitigation & Patch Guidance

Patch confidence for this report is 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description asserts that the defect is fixed in @fastify/multipart 10.1.1 and instructs users to upgrade; however, no vendor advisory, package diff, or source commit has been ingested by the tracked patch sources, so the equivalence "CVE-2026-19474 fixed in 10.1.1" must be verified in the target environment before declaring remediation complete.

1. Immediate mitigations. Restrict or remove unauthenticated access to multipart upload endpoints; place them behind authentication and, if feasible, IP allow-listing or a WAF with upload volumetric rate limiting. Enforce request body size limits at the proxy layer so that partial-upload windows are minimized. Monitor free disk space on the filesystem holding the temporary upload directory and alert on unusual consumption rates. If possible, mount the temporary directory on a dedicated, quarantineable filesystem or tmpfs so that a leak cannot exhaust the primary disk.

2. Patch / upgrade steps. Upgrade @fastify/multipart to version 10.1.1 or later in development and staging environments, validate multipart upload, abort, and disconnect behaviors, then promote to production. If 10.1.1 is not yet available in the organization's package mirror, pin the package to the newest 10.x release and re-check the advisory. Audit application code for all call sites of request.saveRequestFiles() and confirm that any custom error handling does not suppress the iterator rejection that triggers this flaw.

3. Long-term hardening. Establish a scheduled cleanup job (e.g., systemd-tmpfiles or equivalent) that removes stale files from the upload temporary directory beyond a short TTL. Standardize on streaming uploads to object storage instead of local temporary file persistence where feasible. Add detection rules from the Detection Guidance section to SIEM and IDS/IPS pipelines, and subscribe to the official Fastify advisory feed to catch follow-on incomplete-fix variants, given that CVE-2026-19474 itself is a successor to CVE-2025-24033.

References

1. NVD — CVE-2026-19474: https://nvd.nist.gov/vuln/detail/CVE-2026-19474
2. NVD — CVE-2025-24033 (related predecessor, incomplete-fix variant): https://nvd.nist.gov/vuln/detail/CVE-2025-24033
3. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. MITRE CWE-459 Incomplete Cleanup: https://cwe.mitre.org/data/definitions/459.html

CISA KEV: CVE-2026-19474 is not listed in CISA's Known Exploited Vulnerabilities catalog. No threat-actor campaigns or exploit-in-the-wild evidence have been identified in tracked sources as of the writing of this report. PoC/exploit status remains unknown; the analysis and detection guidance provided above are based on the vulnerability class and the NVD description rather than on confirmed exploit artifacts.