CVE-2026-19481

Executive Summary

CVE-2026-19481 is an unauthenticated denial-of-service vulnerability in @fastify/busboy, a multipart form-data parser widely used by Node.js web applications — most notably through the Fastify framework ecosystem. Versions 1.0.0 through 3.2.0 are affected. An attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The vulnerability has a CVSS score of 7.5 (High) with a network attack vector, low attack complexity, and no privileges or user interaction required. The fix is available in version 3.2.1, which changes the header object to have a null prototype.

Technical Analysis

The root cause of CVE-2026-19481 lies in the internal header parsing mechanism of @fastify/busboy. The parser stores incoming multipart part headers in a plain JavaScript object, which by default inherits properties from Object.prototype. The parser assumes that every value stored in this object is an array, because multipart headers can appear multiple times and are collected into arrays during parsing.

When an attacker sends a multipart part with a header name that collides with a prototype-inherited property — such as __proto__ or constructor — the lookup of that property name returns the inherited value from the prototype chain instead of a parser-managed array. Prototype-inherited properties like __proto__ resolve to an object (the prototype itself) or a function (in the case of constructor), both of which are truthy but are not arrays. When the parser subsequently attempts to perform an array-specific operation (such as push or length checking) on this non-array truthy value, a TypeError is thrown.

The error propagation depends on the integration pattern:

1. Pipe integration (common pattern): The failure surfaces as an error event on the stream. Applications that do not register an error handler may crash, and even those with handlers experience a denial of service because the parser becomes inoperable.

2. Direct write or end usage: The exception is thrown synchronously. In this mode, the exception propagates up the call stack and can terminate the Node.js process entirely, without any opportunity for the application to catch it in a stream error handler.

The vulnerability is classified under CWE-754 (Improper Check for Unusual or Exceptional Conditions), which aligns with the parser's failure to validate that the stored header value is actually an array before performing array-specific operations.

The attack surface is any HTTP endpoint that accepts multipart/form-data requests. This is a common feature in web applications for file uploads, form submissions with binary data, and API endpoints. The attack does not require authentication, making it particularly dangerous for internet-facing services.

The fix in version 3.2.1 creates the header object with a null prototype (Object.create(null)), which eliminates the prototype chain inheritance and ensures that property lookups only return values explicitly assigned by the parser.

Exploitation Scenarios

Step 1: Reconnaissance / Target Identification The attacker identifies targets running Node.js applications that use @fastify/busboy for multipart parsing. This can be accomplished by fingerprinting the server response headers, observing the X-Powered-By: Fastify header or other framework indicators, or analyzing error messages that leak library names. Applications using Fastify with file upload capability or any endpoint accepting multipart form-data are prime candidates.

Step 2: Triggering the Vulnerability Class The attacker constructs a multipart/form-data request where a part header uses a prototype-inherited property name. Specifically, a header line such as __proto__: arbitrary-value or constructor: arbitrary-value within a multipart part section. Because these are valid header name characters in the multipart grammar, the parser accepts them and proceeds to store them in the vulnerable header object.

Step 3: Payload / Execution Method The multipart request is submitted to the target endpoint. The parser processes the malicious part header, resolves the prototype-inherited property, and attempts to treat a non-array truthy value as an array. The resulting TypeError propagates according to the integration mode:

• In pipe-mode integrations, an error event is emitted; if no handler is registered, the process may crash.
• In direct write/end usage, the exception is thrown synchronously, causing immediate process termination. The attack can be repeated to restart the crash cycle, making the service effectively unavailable.

Step 4: Post-Exploitation Impact A single crafted request can terminate the Node.js process. If the application runs without process managers that auto-restart workers, the service remains down until manual intervention. Even with auto-restart, repeated requests create a crash-loop pattern, rendering the service unavailable. No code execution, data exfiltration, or privilege escalation is possible — this is a pure availability impact. No public PoC is available at the time of writing; the attack chain is inferred from the vulnerability class and NVD description.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. This reflects:

• Attack Vector (AV:N): The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC:L): No special conditions are needed; the attacker simply sends a malformed multipart request.
• Privileges Required (PR:N): No authentication is required.
• User Interaction (UI:N): No user action is needed.
• Availability Impact (A:H): Complete denial of service — process termination.
• Confidentiality/Integrity Impacts: None.

Affected Systems: All Node.js applications using @fastify/busboy versions 1.0.0 through 3.2.0. This includes any Fastify-based web services that parse multipart form-data, as well as standalone applications using the busboy parser directly. The parser is a low-level component, so many higher-level frameworks may also be indirectly affected if they depend on @fastify/busboy.

Blast Radius: The vulnerability is trivially exploitable by any unauthenticated attacker with network access. For internet-facing services, this means global exposure. The attack requires minimal bandwidth and a single request can take down a server. In cluster or multi-worker deployments, each worker must be individually crashed, but an attacker can automate this. The primary business impact is availability loss, which for critical e-commerce, SaaS, or API services translates directly to revenue loss, SLA violations, and reputational damage.

Detection Guidance

Sigma Rule

title: Suspicious Multipart Part Header with Prototype Property Names
id: 7e3c2f8a-5c21-4d8e-b9f4-61c82d9ae403
status: experimental
description: Detects HTTP requests with multipart form-data part headers using prototype-inherited property names (e.g., __proto__, constructor) that trigger CVE-2026-19481 in @fastify/busboy.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19481
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    category: webserver
    product: generic
detection:
    selection_method:
        http.method: POST
        http.content_type|contains: multipart/form-data
    selection_header:
        http.body|contains|all:
            - '__proto__:'
            - 'constructor:'
    condition: selection_method and selection_header
level: high
falsepositives:
    - Legitimate use of "__proto__" as a header name is extremely rare and should be investigated.
fields:
    - client.ip
    - http.url
    - http.user_agent

YARA Rule

rule CVE_2026_19481_Busboy_Prototype_Header
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects multipart form-data payloads attempting to exploit prototype-inherited header property names in @fastify/busboy"
        date = "2026-01-01"
        cve = "CVE-2026-19481"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19481"
        severity = "high"
    strings:
        $s1 = "__proto__:" ascii wide nocase
        $s2 = "constructor:" ascii wide nocase
        $s3 = "multipart/form-data" ascii wide nocase
        $s4 = "Content-Disposition:" ascii wide nocase
        $s5 = "Content-Type:" ascii wide nocase
        $s6 = "--" ascii wide
    condition:
        uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or
        (any of ($s1, $s2) and $s3) or
        (any of ($s1, $s2) and $s4) or
        (any of ($s1, $s2) and $s5) or
        (any of ($s1, $s2) and $s6)
}

Suricata IDS Rule

alert http any any -> $EXTERNAL_NET any (msg:"CVE-2026-19481 Fastify Busboy Prototype Pollution Header DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.content_type; content:"multipart/form-data"; http.request_body; content:"__proto__:"; nocase; http.request_body; content:"constructor:"; nocase; classtype:attempted-dos; sid:1948101; rev:1; reference:cve,2026-19481; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-19481;)

Note on Suricata rule: The above rule is limited by Suricata's HTTP body inspection capabilities for multipart content. Multiple keywords for body content may not work reliably in all deployments; adjust keywords and offsets based on your sensor capabilities. For raw packet inspection of multipart payloads, consider the following alternative:

alert tcp any any -> any any (msg:"CVE-2026-19481 Busboy Prototype Header DoS - Raw TCP Match"; flow:established,to_server; content:"multipart/form-data"; nocase; content:"__proto__:"; nocase; content:"constructor:"; nocase; content:"Content-Disposition:"; nocase; within:4096; classtype:attempted-dos; sid:1948102; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where event.type == "start" and destination.port == 80 or destination.port == 443 ]
  [ http where process.name == "node" and http.request.method == "POST" and
    http.request.content_type == "multipart/form-data" and
    wildcard(http.request.body, "*__proto__:*") ]
  [ http where process.name == "node" and http.request.method == "POST" and
    http.request.content_type == "multipart/form-data" and
    wildcard(http.request.body, "*constructor:*") ]

Splunk SPL Query

index=web* OR index=proxy* sourcetype=access_* 
| where like(method, "%POST%") AND like(form_data, "%multipart/form-data%")
| where like(_raw, "%__proto__:%") OR like(_raw, "%constructor:%")
| where NOT like(_raw, "%__proto__=undefined%") 
| stats count by clientip, uri, _time, _raw
| sort - _time
| table _time, clientip, uri, count, _raw

Wazuh OSSEC Rule

<group name="web, fastify, dos, CVE-2026-19481,">
  <rule id="194810" level="12">
    <decoded_as>json</decoded_as>
    <field name="method">POST</field>
    <field name="content_type">multipart/form-data</field>
    <match>__proto__:|constructor:</match>
    <description>CVE-2026-19481 - @fastify/busboy prototype-inherited header DoS attempt detected</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack.dos,</group>
    <info type="cve">CVE-2026-19481</info>
    <info type="url">https://nvd.nist.gov/vuln/detail/CVE-2026-19481</info>
  </rule>
  
  <rule id="194811" level="10">
    <if_sid>194810</if_sid>
    <same_field>srcip</same_field>
    <description>CVE-2026-19481 - repeated exploit attempts from same source IP</description>
    <group>attack.recon, attack.dos,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

Despite the NVD description stating the fix is available in @fastify/busboy 3.2.1, the patch confidence level for this report is 0/4. This indicates that this intelligence source has not independently confirmed or tracked the patch from any official channel. Organizations should verify the fix independently.

Immediate Mitigations (no code change required):

1. Place a reverse proxy or WAF in front of the Node.js application that filters requests containing __proto__: or constructor: within multipart bodies.
2. Implement rate limiting on endpoints accepting multipart uploads to slow automated exploitation attempts.
3. Ensure the Node.js process is configured with a process manager (PM2, systemd) that auto-restarts crashed workers to minimize downtime.
4. Add an error event handler to the busboy stream in pipe integrations to prevent uncaught exception crashes, though this does not fix the underlying availability impact.

Patch / Upgrade Steps:

1. Verify the running version: npm list @fastify/busboy.
2. Check the official npm registry for the latest version: npm view @fastify/busboy versions.
3. Upgrade to the patched version: npm install @fastify/busboy@3.2.1.
4. If using Fastify with @fastify/multipart, ensure it is also updated to a version that depends on the patched busboy.
5. Rebuild and redeploy the application in all environments (dev, staging, production).
6. Run a regression test suite with multipart uploads to confirm functionality.

Long-Term Hardening:

1. Maintain a dependency scanning process (e.g., npm audit, Snyk, Dependabot) for automated vulnerability detection.
2. Subscribe to Fastify and @fastify/busboy release notifications for future security advisories.
3. Santize or reject multipart part header names that match Object.prototype properties in any custom parser or validation layer.
4. Add network-level detection rules (see Detection Guidance section) to your IDS/IPS.
5. Consider upgrading to a more actively maintained multipart parser if @fastify/busboy does not receive timely updates for future issues.
6. Conduct periodic penetration tests focused on parser-level vulnerabilities, which are often overlooked.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19481
2. @fastify/busboy npm package: https://www.npmjs.com/package/@fastify/busboy
3. Fastify Framework Official Site: https://fastify.dev/
4. CWE-754 (Improper Check for Unusual or Exceptional Conditions): https://cwe.mitre.org/data/definitions/754.html
5. MITRE ATT&CK T1499 (Endpoint Denial of Service): https://attack.mitre.org/techniques/T1499/

Threat Actor Activity: No known threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-19481 at the time of writing. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. PoC/exploit availability is currently unknown, and no public exploit code has been observed. Security teams should treat this as a high-priority exposure given the low exploitation complexity, even without public exploit code, as crafting the malicious request is trivial based on the vulnerability description alone.