CVE-2023-25576
Assigner: GitHub_M
Published: 2023-02-14T15:04:11.119Z
State: PUBLISHED
title: @fastify/multipart vulnerable to DoS due to unlimited number of parts
problemTypes: descriptions: cweId: CWE-770
description: CWE-770: Allocation of Resources Without Limits or Throttling
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
affected: vendor: fastify
product: fastify-multipart
versions: version: < 6.0.1
status: affected
version: >= 7.0.0, < 7.4.1
status: affected
descriptions: value: @fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experience denial of service due to a number of situations in which an unlimited number of parts are accepted. This includes the multipart body parser accepting an unlimited number of file parts, the multipart body parser accepting an unlimited number of field parts, and the multipart body parser accepting an unlimited number of empty parts as field parts. This is fixed in v7.4.1 (for Fastify v4.x) and v6.0.1 (for Fastify v3.x). There are no known workarounds.
source: advisory: GHSA-hpp2-2cr5-pf6g
discovery: UNKNOWN