high7.5
CVE-2025-24033
Unlimited consumption of resources in @fastify/multipart
Impact
### Impact The `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. ### Patches Fixed in version 8.3.1 and 9.0.3 ### Workarounds Do not use `saveRequestFiles`. ### References This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @fastify/multipart | <= 8.3.0 | 8.3.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/fastify/fastify-multipart/issues/546
- https://github.com/fastify/fastify-multipart/pull/567
- https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fh
- https://github.com/advisories/GHSA-27c6-mcxv-x3fh
- https://nvd.nist.gov/vuln/detail/CVE-2025-24033