CVE-2026-19484

Executive Summary

CVE-2026-19484 is a high-severity denial-of-service (DoS) vulnerability in the @fastify/busboy multipart form-data parser library, affecting versions 3.1.0 through 3.2.0. A remote unauthenticated attacker can stall the Node.js event loop by crafting a multipart request with a boundary of a specific length (252 bytes), triggering a CPU-bound loop that consumes one full core per request. Because Node.js is single-threaded, this prevents the process from handling any other requests, resulting in application-level denial of service. The vulnerability is fixed in version 3.2.1, which widens the skip table to preserve skip distance; no vendor patch or workaround is currently available for affected versions.

Technical Analysis

The vulnerability resides in the streaming search algorithm used by @fastify/busboy to locate multipart boundaries within incoming request payloads. Multipart form-data requests define boundaries as delimiter strings that separate parts; the parser must efficiently search the incoming byte stream for these boundary strings to correctly delimit content.

The underlying mechanism exploits an implementation detail in the Boyer-Moore-style search algorithm used by the vendored streaming search component. The search algorithm precomputes a skip table—an array that determines how far the search pointer can advance when a mismatch occurs. This skip table is stored in a fixed 256-entry byte array, which indexes possible byte values (0–255). The skip distance for each byte is normally calculated by the standard Boyer-Moore bad-character heuristic, which yields a value large enough to allow the search to skip ahead efficiently when a mismatch occurs.

A boundary string crafted to exactly 252 bytes causes the search needle to be 256 bytes in total. This is the critical trigger: because the needle's last-byte index is 255, and the skip table is a 256-byte array indexed by byte value, the skip distance value stored for each byte gets truncated or zeroed out due to an offset/array-indexing wrap. Specifically, the calculation that determines how far the search can skip on a mismatch is derived from the position of the last occurrence of each byte, and with a 256-byte needle, every possible byte value 0–255 appears somewhere within the needle. This causes every entry in the skip table to be either zero or a distance that results in the search advancing by only one byte per comparison.

Consequently, the search degenerates from a sub-linear Boyer-Moore scan into a naive byte-by-byte linear scan. For a small body—even a few hundred bytes—the search loop becomes CPU-bound, performing 256 comparisons per position without skipping. The result is a tight loop that consumes 100% of one CPU core.

This is a classic algorithmic complexity attack (CWE-835, "Use of Incorrectly Calculated Variable-Skewed Data" / algorithmic complexity DoS). The attacker does not need any authentication; the vulnerability is triggered purely by the structure of the request payload. The request must:

1. Use a valid multipart/form-data Content-Type header (or the parser must be engaged).
2. Have a boundary string of exactly 252 bytes.
3. Contain a small body (a few bytes of content) so that the parser attempts to match the 256-byte boundary against the stream.

Because the search operates on the incoming stream and the parser is synchronous (event-loop-blocking), the CPU-bound loop stalls the entire Node.js event loop for as long as the search runs. A single small request can keep one core busy; an attacker sending multiple concurrent requests can saturate all cores on the server, causing complete denial of service for all other requests handled by the same process.

Attack surface: Any Node.js application using @fastify/busboy 3.1.0–3.2.0 to parse multipart uploads (file uploads, form submissions) is exposed. This includes Fastify-based web applications, microservices, and API gateways that handle uploads. The attack requires only that the application uses the vulnerable parser and accepts unauthenticated multipart requests—a common configuration for public upload endpoints.

Fix analysis: Version 3.2.1 widens the skip table (preserving the calculated skip distance even for needle lengths up to 256 bytes), which restores the algorithm's sub-linear time complexity. The vendor fix is described but no patch details, commit hashes, or differential analysis are available from tracked sources.

Exploitation Scenarios

Attack chain (inferred from vulnerability class; no public PoC or exploit code is available):

Step 1 — Reconnaissance/Target Identification: An attacker identifies a public-facing Node.js service that accepts multipart/form-data uploads. This can be done by:

• Fuzzing URL endpoints for HTTP 413 (Payload Too Large) or observing response times on POST requests with multipart/form-data content type.
• Fingerprinting the server via response headers (X-Powered-By: Fastify or similar) or error messages that reveal the underlying framework.
• Reviewing public API documentation for upload endpoints that do not require authentication.

Step 2 — Flaw Class Triggering: The attacker crafts a multipart request with a boundary string of exactly 252 bytes. The boundary is embedded in the Content-Type header:

Content-Type: multipart/form-data; boundary=AAAA... (252 bytes of 'A')

The body contains a small payload (e.g., a single field or file) that forces the parser to enter the streaming search for the boundary.

Step 3 — Payload/Execution: The request is sent to the target. The parser invokes the vulnerable search with a 256-byte needle (252-byte boundary plus framing characters). The skip table truncation causes the search to become a CPU-bound loop. One request occupies one core indefinitely. The attacker sends multiple concurrent requests to saturate all available cores.

Step 4 — Post-Exploitation Impact: The Node.js event loop is stalled. All other HTTP requests—including legitimate traffic, health checks, and API calls—time out or hang. The application becomes completely unresponsive.

• Denial of service for all consumers of the service.
• Cascading failures: load balancers mark the instance as unhealthy and redirect traffic, potentially overloading healthy instances (thundering herd).
• Operational impact: log aggregation, monitoring agents, and graceful shutdown routines may also be starved of CPU.
• Mitigation cost: the only recovery is restarting the Node.js process or killing the stalled worker.

No public PoC or exploit-in-the-wild evidence is available at this time. The attack chain is inferred from the vulnerability class and the NVD description. The exact boundary characters, request framing details, and trigger conditions beyond "boundary of exactly 252 bytes" are not publicly disclosed.

Impact Assessment

CVSS Score: 7.5 (High) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

• Attack Vector: Network — the vulnerability is exploitable remotely.
• Attack Complexity: Low — no special conditions or race conditions required.
• Privileges Required: None — unauthenticated.
• User Interaction: None — no user action needed.
• Scope: Unchanged — the impact stays within the vulnerable component.
• Confidentiality Impact: None — no data disclosure.
• Integrity Impact: None — no data modification.
• Availability Impact: High — complete loss of availability for the Node.js process.

Business Impact:

• Availability: The primary impact is total denial of service for the application process. For a web service receiving sustained traffic, a single request can stall one core; a handful of concurrent requests can render the service completely unresponsive.
• Blast radius: Every Node.js application using @fastify/busboy 3.1.0–3.2.0 in a production environment is affected. This includes Fastify web servers, microservices, API gateways, and any middleware that delegates multipart parsing to @fastify/busboy. Applications that expose unauthenticated upload endpoints are at the greatest risk.
• Operational impact: Unlike network-level DDoS, this attack consumes minimal bandwidth—each request is small. Traditional rate limiting and network-layer DDoS mitigation do not prevent it. Application-level filters (e.g., blocking overly long boundaries) are the only immediate mitigation.
• Financial impact: Extended downtime for revenue-generating services, incident response costs, and potential SLA penalties.

Worst-case scenario: An attacker discovers a Fastify-based public upload service, sends a burst of 8–16 requests with 252-byte boundaries (each request only a few hundred bytes total), and renders the service completely unavailable for the duration of the attack. The attacker can repeat this indefinitely.

Detection Guidance

Sigma Rule

title: Fastify Busboy Boundary Length DoS Attempt
id: 0f4a8c2e-9d15-4f8a-b7c3-2f6e5d4a8b21
status: experimental
description: Detects HTTP multipart requests with unusually long boundary strings (>= 200 bytes) that may attempt to exploit CVE-2026-19484.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-19484
author: Valtersit Threat Intelligence
date: 2026-02-15
tags:
    - attack.t1499
    - cve.2026.19484
logsource:
    category: webserver
    product: nodejs
detection:
    selection:
        http.request.method: POST
        http.content_type|contains: multipart/form-data
    filter_boundary:
        http.content_type|contains: 'boundary='
    condition: selection and filter_boundary
fields:
    - client.ip
    - http.url
    - http.content_type
falsepositives:
    - Legitimate multipart uploads with unusually long boundary strings (rare)
level: high

YARA Rule

rule Fastify_Busboy_CVE_2026_19484_DOS {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects multipart HTTP requests with a 252-byte boundary, indicating an attempt to exploit CVE-2026-19484"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-19484"
        date = "2026-02-15"
        cve = "CVE-2026-19484"
        severity = "high"
    strings:
        $boundary_marker = "boundary=" ascii
        $multipart_ct = "multipart/form-data" ascii nocase
    condition:
        $multipart_ct and $boundary_marker and #boundary_marker >= 1 and // detect in HTTP header captures
        // The boundary value length must be ~252 bytes; check for long runs of non-quote chars
        any of them and filesize > 256
}

Note: A robust YARA rule for this CVE requires boundary extraction logic that is difficult to express in pure YARA. The rule above matches the HTTP Content-Type header; SOC analysts should combine it with manual inspection of the boundary length.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-19484 Fastify Busboy Multipart Boundary DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.header; content:"multipart/form-data"; nocase; content:"boundary="; nocase; pcre:/boundary=[^\r\n;]{250,}/; classtype:attempted-dos; sid:202619484; rev:1; metadata:cve CVE-2026-19484, attack_target server, created_at 2026-02-15;)

Elastic Detection

// Detect HTTP POST requests with multipart/form-data content-type
// and an unusually long boundary parameter (>= 250 chars)
// that may indicate an attempt to exploit CVE-2026-19484 on Node.js/Fastify servers

where event.category == "http" and http.request.method == "POST"
    // Use a regex-like pattern on the content-type header
    and http.request.content_type like "*multipart/form-data*"
    and length_of_boundary(http.request.content_type) >= 250  // custom function; see note below

Note: Elastic EQL does not natively support extracting and measuring a header parameter length. In practice, use a processor (e.g., ingest pipeline with dissect or JavaScript) to extract the boundary value and compute its length, then filter on that field.

Splunk SPL Query

index=* sourcetype=iis OR sourcetype=apache OR sourcetype=nginx OR sourcetype=nodejs*
| where match(_raw, "multipart/form-data")
| regex _raw = "(?i)boundary=[^;]{250,}"
| eval boundary_len = length(regex_extract(_raw, "(?i)boundary=([^;\r\n]+)", 1))
| where boundary_len >= 250
| stats count earliest(_time) latest(_time) by src_ip, uri_path, boundary_len
| sort -count
| rename src_ip as "Source IP", uri_path as "Request Path", count as "Request Count"

Wazuh OSSEC Rule

<group name="fastify_busboy_dos,">
  <rule id="100948" level="12">
    <decoded_as>json</decoded_as>
    <field name="http_request_content_type">multipart/form-data</field>
    <field name="http_request_method">POST</field>
    <regex>boundary=[^;]{250,}</regex>
    <description>CVE-2026-19484: Fastify Busboy multipart boundary length DoS attempt detected</description>
    <group>attack.t1499, cve.2026.19484</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (per tracking sources). Despite the NVD description stating that version 3.2.1 contains the fix, patch evidence from tracked sources is currently absent. This may indicate a gap in patch tracking. Verify the upgrade before relying on it.

1. Immediate Mitigations (no code change required):

• Upgrade to @fastify/busboy 3.2.1 as soon as possible. The vendor-fixed version widens the skip table and preserves skip distance. Verify the installed version with npm list @fastify/busboy and update via npm update @fastify/busboy.
• Rate limiting at the application level: Since the attack requires a valid multipart request, implement rate limiting on upload endpoints to limit requests per IP.
• Boundary length validation: Add a middleware or reverse-proxy rule to reject requests whose Content-Type header contains a boundary parameter longer than e.g. 200 characters. This can be done at the reverse proxy (Nginx, HAProxy, CDN).
• Web Application Firewall (WAF): Deploy a WAF rule to block requests with Content-Type: multipart/form-data and a boundary length > 200 characters.
• Worker isolation: Run Node.js with a process supervisor (PM2, systemd) configured to restart workers that exceed CPU thresholds, mitigating persistent DoS.

2. Patch/Upgrade Steps:

• Check your application's dependency tree: npm ls @fastify/busboy.
• Upgrade to 3.2.1: npm install @fastify/busboy@3.2.1 (or update the parent package, e.g., Fastify, that depends on it).
• Re-test multipart upload functionality after upgrade.
• Note: If 3.2.1 is not yet available in your registry, pin the vulnerable version and apply the boundary-length filtering mitigation.

3. Long-Term Hardening:

• Dependency monitoring: Integrate SCA (Software Composition Analysis) tools such as Snyk, Dependabot, or Trivy to explicitly track @fastify/busboy and all transitive dependencies.
• Fuzzing: Add multipart parser fuzzing to your CI/CD pipeline to detect algorithmic-complexity issues before release.
• Architecture: For high-availability services, consider offloading multipart parsing to a separate process or service so a DoS on the parser does not stall the main application event loop.
• Security testing: Include algorithmic complexity DoS vulnerabilities in your security testing checklist (CWE-835).
• Monitoring: Deploy Node.js event-loop delay monitoring (using process.hrtime() based latency probes) and alert on anomalous event-loop blocking.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-19484 (Primary reference; contains the CVSS vector, CWE-835 classification, and affected versions.)

2. Vendor Advisory (speculative — verify): https://github.com/fastify/busboy/releases (Release notes for @fastify/busboy 3.2.1 should contain the fix description. Patch details may be absent from tracked sources per metadata.)

3. Skip table / Boyer-Moore algorithmic complexity reference: https://en.wikipedia.org/wiki/Boyer%E2%80%93Moore_string-search_algorithm (Background on the algorithm class being exploited.)

4. CWE-835 Reference: https://cwe.mitre.org/data/definitions/835.html (MITRE entry for algorithmic-complexity denial-of-service.)

5. CISA KEV: Not listed. No exploit-in-the-wild evidence has been reported to CISA as of the report date. No known threat actor campaigns associated with this CVE.

Threat Actor / Exploit-in-the-Wild Status: No public evidence of weaponization, proof-of-concept code, or active exploitation campaigns has been identified at the time of writing. The vulnerability is considered high-risk due to its trivial exploitability and the popularity of the @fastify/busboy library within the Node.js ecosystem. Monitor vendor and researcher channels for the release of a public PoC, which is likely given the simplicity of the trigger condition.