CVE-2026-74866

Executive Summary

CVE-2026-74866 is an input validation vulnerability in the @fastify/busboy multipart form-data parser for Node.js, affecting all versions up to and including 3.2.1. The parser's part-header splitting logic only recognizes the two-byte carriage-return line-feed (CRLF) sequence as a line terminator, causing lone carriage return (CR, \r) or line feed (LF, \n) characters embedded within a part header to be passed verbatim into parsed values such as Content-Disposition filename and field name. An unauthenticated attacker can exploit this flaw by uploading a multipart request containing a filename or field name with embedded bare CR/LF bytes, enabling CRLF injection into downstream sinks including filesystem operations, logging infrastructure, and HTTP headers. The vulnerability is fixed in @fastify/busboy version 3.2.2, which rejects any header line still containing an unpaired CR or LF. The CVSS score is 5.8 (medium severity) with a CVSS vector of AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, reflecting network exploitability without authentication and a scope change affecting integrity only.

Technical Analysis

Vulnerability Mechanism

The vulnerability resides in how @fastify/busboy parses multipart form-data part headers. The multipart specification (RFC 7578, derived from RFC 2046) stipulates that MIME part headers are terminated by CRLF sequences. The parser correctly splits header lines on the CRLF two-byte sequence. However, the flaw is in how the parser handles header lines that contain unpaired CR or LF bytes—specifically, a single \r (0x0D) or single \n (0x0A) that is not part of a \r\n pair.

Because the parser only tokenizes on the two-byte CRLF delimiter, a bare \r or \n embedded in the middle of a header value (e.g., within a Content-Disposition header's filename parameter) is not treated as a terminator. Instead, the raw byte is carried through and preserved in the final parsed output that is handed to the calling Node.js application. Since HTTP multipart parsing is fundamentally a byte-parsing exercise (not string-based), these control bytes survive all validation stages that operate on text-level semantics rather than raw byte sequences.

Consumers that receive the parsed values—such as the filename parameter from the Content-Disposition header or the form field name—may pass these values into sinks that are sensitive to CR/LF characters. Common examples include:

1. Filesystem operations: Node.js fs.writeFile() or libraries that use the filename for path construction. A bare \n in a filename can be interpreted by certain filesystems or path-normalization functions as a directory separator or cause path traversal behavior. A bare \r can confuse terminal displays and downstream processing tools.
2. Logging: If the parsed filename or field name is embedded into log lines without escaping, the injected CR/LF terminates the current log entry and allows the attacker to forge additional log lines—a technique known as log forging (ISO/IEC 11770 log injection).
3. Header injection: If the value is forwarded to an HTTP header sink (e.g., a Location header or a Content-Disposition response header derived from the uploaded filename), a CRLF can terminate the current header and allow injection of arbitrary additional headers—classic HTTP response splitting/smuggling primitives.

Root Cause Class

This maps to CWE-93 (Improper Neutralization of CRLF Sequences), also known as CRLF injection. The parser fails to sanitize or reject control characters in header parameter values, and critically fails to distinguish between the CRLF delimiter and standalone CR or LF bytes.

Fix Analysis

Version 3.2.2 addresses the issue by adding a post-parsing validation step: after header extraction, any header line that still contains a bare \r or \n (i.e., one not paired as CRLF) is rejected outright. This is a whitelist-based fix at the parser boundary, ensuring that no consumer downstream ever receives a header value containing unpaired control characters. Given the nature of the fix and its confirmation from two independent sources (NVD and OSV), patch confidence is rated 3/4—LIKELY.

Exploitation Scenarios

Scenario 1: File Upload Endpoint — Filesystem Filename Pollution and Potential Path Traversal

Step 1 — Reconnaissance/Target Identification: An attacker identifies a Node.js web application that uses @fastify/multipart (which wraps @fastify/busboy) to handle file uploads. The application might be an API gateway, a document management system, a web mail service, or any HTTP-facing service accepting multipart/form-data. Shodan queries targeting Node.js/Fastify markers in response headers or HTML content can identify such services.

Step 2 — Triggering the Flaw Class: The attacker crafts a multipart/form-data HTTP request to the vulnerable endpoint. In the Content-Disposition header of the file part, the attacker includes a filename parameter whose value contains an embedded bare \n (0x0A) or \r (0x0D). For example:

Content-Disposition: form-data; name="upload"; filename="legit\n../../etc/cron.d/newjob"

Because the parser only splits on full CRLF (\r\n), the sequence \n alone does not terminate the header, so the entire string becomes the filename passed to the application.

Step 3 — Payload/Execution at the Class Level: When the application uses the filename value in a filesystem write operation (e.g., saving the uploaded file to disk using a path derived from the filename), the embedded \n may be interpreted as a path separator by some path-normalization libraries, or the \n can break out of the filename into subsequent path components. If the application constructs paths as path.join(destinationDir, filename), certain string operations that split on newlines could allow directory traversal. Even in simpler cases, the injected bytes corrupt the intended filename, causing storage of files with unexpected names or locations (filesystem filename pollution). If the application later reads back filenames from the storage directory and processes them without sanitization, a file containing CR/LF characters in its name could trigger a chain reaction in downstream log systems or monitoring agents.

Step 4 — Post-Exploitation Impact: At minimum, the attacker corrupts the storage namespace with malicious filenames, potentially overwriting existing files if the constructed filename collides with a valid one after the injected CR/LF is stripped or interpreted by certain filesystems. In more severe scenarios involving path separators in filenames, the attacker may achieve restricted directory traversal. However, given the CVSS integrity subscore (I:L), direct file overwrite outside expected directories is unlikely without auxiliary vulnerabilities.

Scenario 2: Log Forging via Field Name Injection

Step 1 — Reconnaissance: The attacker identifies an endpoint that writes multipart field names or filenames into application logs (e.g., audit logs for upload actions, security monitoring logs).

Step 2 — Triggering: The attacker submits a multipart request where the field name (the name parameter in Content-Disposition) contains a payload such as:

name="injection\r\n[FABRICATED LOG ENTRY]"

Step 3 — Execution: The parser passes the field name to the application; the application logs a message like "User uploaded file with field: " + fieldName. The injected CRLF terminates the legitimate log line, and the fabricated content becomes a new log line.

Step 4 — Post-Exploitation: The attacker forges log entries to frame other users, hide their own malicious activity, or mislead SOC analysts. Log forging can compromise the integrity of forensic evidence and disrupt automated log-analysis pipelines (e.g., SIEM correlation rules that pattern-match on log content).

Impact Assessment

Business Impact

• Integrity Impact (Low): The attack vector permits modification of filenames and field names that flow into downstream sinks. While direct data corruption is possible (filename pollution, overwriting files via path-element injection), the attack does not grant read access to confidential data (Confidentiality Impact: None).
• Availability Impact (None): The vulnerability cannot be used to directly crash services or cause denial of service in the parser itself.
• Scope Change (Yes): The CVSS vector includes S:C, indicating that the vulnerable component (the parser) impacts a resource beyond its security scope—namely, the consuming application's filesystem, logs, or HTTP output.

Affected Systems

• All Node.js applications using @fastify/busboy version ≤ 3.2.1 either directly or transitively via @fastify/multipart.
• This includes Fastify-based web servers, API gateways, and microservices that expose multipart/form-data file upload endpoints.

Blast Radius

• Broad reach: The parser is widely used in the Node.js ecosystem; @fastify/multipart has a large installed base given Fastify's popularity for high-throughput HTTP servers.
• Unauthenticated attack: CVSS PR:N indicates no privileges required; any external attacker able to reach an upload endpoint can attempt exploitation.
• EPSS score of 0.00193 with a 9.0% percentile suggests low current exploitation in the wild, but this may increase once exploit tooling matures. The vulnerability class (CRLF injection into multipart parsing) is well-understood by attackers, and PoC information is already public.

Detection Guidance

Sigma Rule

title: Fastify Busboy CRLF Injection in Multipart Headers (CVE-2026-74866)
id: 9d2c3f4a-5b6c-4d7e-8f9a-0b1c2d3e4f5a
status: experimental
description: Detects HTTP requests containing bare CR or LF characters in multipart part-header filenames or field names, indicative of CVE-2026-74866 exploitation attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-74866
    - https://github.com/fastify/busboy
author: Valtersit Security Research
date: 2026/02/15
tags:
    - attack.t1190
    - attack.t1055
    - cve.2026.74866
logsource:
    category: webserver
    product: generic
detection:
    selection_multipart_request:
        cs-method: POST
        http.content_type|contains: multipart/form-data
    selection_crlf_in_header:
        # Suricata/Zeek HTTP logs store request headers. The raw body headers are inspectable via
        # proxy logs or raw packet captures (see Suricata rule). For web server logs, detection relies on
        # the server-side access log capturing the full URI or header values. This pattern matches
        # encoded or raw CR/LF.
        http.request_headers|contains:
            - 'filename="*%0a*'
            - 'filename="*%0d*'
            - 'name="*%0a*'
            - 'name="*%0d*'
    condition: selection_multipart_request and selection_crlf_in_header
falsepositives:
    - Legitimate uploads with unusual filenames containing encoded newlines are extremely rare.
level: high

YARA Rule

rule CVE_2026_74866_Busboy_CRLF_Injection
{
    meta:
        description = "Detects raw multipart HTTP bodies with bare CR or LF inside Content-Disposition filename/name parameters, matching CVE-2026-74866 exploit payloads"
        author = "Valtersit Security Research"
        date = "2026-02-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-74866"
        cve = "2026-74866"
        score = 80
    strings:
        // Match CRLF pair followed by a bare LF inside a content-disposition header value
        $cd_header = "Content-Disposition" ascii nocase
        $filename_param = "filename=" ascii nocase
        $name_param = "name=" ascii nocase
        // Bare LF not preceded by CR: \x0a where previous byte is not \x0d
        $bare_lf = { 0x0D 0x0A }
        $lf_alone = { [0-1] 0x0A }
        // Bare CR not followed by LF: \x0d followed by non-\x0a
        $cr_alone = { 0x0D }
    condition:
        uint16(0) == 0x0D0A or any of ($cd_header*) and any of ($filename_param*) and any of ($lf_alone, $cr_alone)
}

Note: Parameterized byte-pattern matching in YARA against complete HTTP transactions requires proper flow reassembly. The rule above serves as a template for implementation in network-monitoring contexts such as Moloch/Arkime or Zeek file extraction pipelines.

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Fastify Busboy CRLF Injection in Multipart Content-Disposition (CVE-2026-74866)";
    flow:established,to_server;
    http.method; content:"POST";
    http.header; content:"multipart/form-data"; nocase;
    http.request_body;
    pcre:"/(?:filename|name)\s*=\s*\"[^\"]*\x0a[^\"]*\"/iR";
    pcre:"/(?:filename|name)\s*=\s*\"[^\"]*\x0d[^\"]*\"/iR";
    classtype:attempted-admin;
    sid:202674866;
    rev:1;
    reference:cve,2026-74866;
    metadata:created_at 2026_02_15, updated_at 2026_02_15;
)

Explanation: This rule inspects HTTP POST bodies containing multipart/form-data. The PCRE patterns look for filename= or name= parameters within double quotes where the value contains a bare line feed (\x0a) or carriage return (\x0d) that is not part of the proper CRLF sequence. The i flag makes matching case-insensitive.

Elastic Detection

// EQL rule: Detect HTTP traffic with encoded or raw CR/LF in multipart body
sequence by source.ip
    [ network where event.action == "http_request" and
        method == "POST" and
        http.request.content_type == "multipart/form-data" and
        // Match on raw body containing filename or name followed by encoded CR/LF
        url.path != "*" // placeholder
    ]
    [ file where event.action in ("write", "create") and
        // Match files created with CR/LF in name
        file.name regex~ ".*[\\r\\n].*"
    ]

Simplified EQL variant (event-based root cause detection):

any where
  process.name == "node" and
  file.name regex~ ".*[\x0d\x0a].*"

Rationale: EQL is event-stream oriented. Since the vulnerability manifests downstream in filesystem or log operations, detection is most practical at the point where the tainted filename hits the filesystem (file event) or where logs contain malicious newline sequences. The primary detection should therefore be configured in the SIEM layer using SPL queries or log-aggregation rules rather than raw EQL event rules.

Splunk SPL Query

index=web sourcetype=access_combined_wcookie OR sourcetype=iis OR sourcetype=apache
| where method="POST"
| regex _raw="(?i)(filename|name)=\"[^\"]*%0[dDaA][^\"]*\"|(?i)(filename|name)=\"[^\"]*\\x0[daDA]"
| eval has_encoded_crlf=if(match(_raw, "(?i)%0[dD]|%0[aA]"), "yes", "no")
| eval has_raw_crlf=if(match(_raw, "(?i)\\\\x0[daDA]"), "yes", "no")
| where has_encoded_crlf="yes" OR has_raw_crlf="yes"
| table _time, src_ip, host, uri, http_user_agent, _raw
| sort -_time

Rationale: This SPL query searches web access logs for POST requests to multipart endpoints whose URI or captured request contains URL-encoded CR/LF (%0d/%0a) or raw newline approximations in filename or name parameters. Since most web server logs do not capture the raw request body, this query is most effective when applied to reverse-proxy logs that record full request bodies (e.g., Nginx with $request_body captured) or when used with a WAF event log source.

Wazuh OSSEC Rule

<group name="fastify,busboy,cve-2026-74866,">
  <rule id="100312" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.(php|js|api)/.*upload|multipart</field>
    <field name="http_method">POST</field>
    <regex>filename\\?\"?.*(%0A|%0D|\\\\x0[AD])|name\\?\"?.*(%0A|%0D|\\\\x0[AD])</regex>
    <description>CVE-2026-74866 - Fastify Busboy CRLF injection attempt in multipart filename or field name</description>
    <group>web_application_attack,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Explanation: Wazuh rule triggers on HTTP request logs that contain encoded CR/LF sequences (%0A, %0D) or literal backslash-x representations near filename or name parameters in multipart upload POST requests. Level 12 indicates a high-severity alert.

Mitigation & Patch Guidance

Patch Confidence and Status

Patch confidence is 3/4 — LIKELY, confirmed by two independent sources: NVD and OSV. The vendor fix is version 3.2.2, which adds rejection logic for any header line that contains bare CR or LF bytes after the standard CRLF splitting pass.

1) Immediate Mitigations

• Upgrade @fastify/busboy to version 3.2.2 or later — This is the definitive fix. If you use @fastify/multipart as a wrapper, upgrade that package as well to ensure it pulls in busboy ≥ 3.2.2 (check npm ls @fastify/busboy to verify the resolved version).
• If immediate upgrade is impossible, implement a reverse-proxy or WAF layer (Nginx, HAProxy, AWS WAF, ModSecurity) that inspects multipart/form-data bodies and drops requests where the Content-Disposition header contains a filename or name value with unencoded \r (0x0D) or \n (0x0A).
• Sanitize filenames at the application boundary: Even after upgrading, add a belt-and-suspenders sanitizer that strips or rejects any \r or \n byte from filenames and field names before they are used in filesystem paths, logs, or HTTP responses.

2) Patch and Upgrade Steps

# For direct consumers:
npm install @fastify/busboy@3.2.2 --save

# For @fastify/multipart users:
npm install @fastify/multipart@latest --save
npm update @fastify/busboy

# Verify resolved version:
npm ls @fastify/busboy

# If your lockfile pins old versions, force-resolution:
npm audit fix --force   # review implications first

• After upgrading, run a smoke test: upload a multipart file whose filename contains a bare \n; verify the server rejects the request with a 4xx error.
• Confirm that custom middleware or controllers do not independently re-parse the raw body and introduce the same flaw.

3) Long-Term Hardening

• Routine dependency auditing: Add npm audit to CI/CD pipelines, and subscribe to OSV/NVD RSS feeds for Node.js parser components. Enforce a policy of upgrading multipart parsers within 48 hours of a security release.
• Input validation layers: Never trust parser output as "clean." Treat all parser-derived values (filenames, field names, content types) as untrusted input requiring validation against an allowlist of permitted character classes (e.g., [a-zA-Z0-9._-] for filenames where possible).
• Log hygiene: Ensure all logging mechanisms escape control characters. Use structured logging (JSON) where field values are serialized with proper escaping, reducing CRLF injection impact on logs.
• Security monitoring: Deploy the detection rules above to flag anomalous multipart payloads in transit, providing early warning of attacker reconnaissance and exploitation attempts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-74866
2. OSV Advisory: https://osv.dev/vulnerability/CVE-2026-74866
3. Fastify Busboy GitHub Repository (fix in 3.2.2): https://github.com/fastify/busboy/releases
4. Fastify Multipart (affected consumer): https://github.com/fastify/fastify-multipart
5. MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Exploitation-in-the-Wild Evidence: No known state-sponsored or criminal campaigns leveraging CVE-2026-74866 have been observed as of the publication date. The EPSS score of 0.00193 (9.0th percentile of exploited CVEs) and the absence of CISA KEV listing indicate low imminent exploitation risk. However, the public availability of PoC-style descriptions and the broad installed base of Fastify in production environments warrant prompt remediation despite current low exploitation rates.