01 Record

CVE-2026-74866

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

MediumPUBLISHEDCNA: openjs

Base score5.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

02 Description

@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

Published

2026-08-21 08:20Z17 HR AGO

Last updated

2026-08-21 12:37Z13 HR AGO

Reserved

2026-08-17

Assigning CNA

openjs

Record state

PUBLISHED

Severity

Medium (CVSS 5.8)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Weaknesses

SSVC decision

ExploitationnoneAutomatableyesTechnical Impactpartial

Data version

5.2

Document digest

1561980cd6ed268b7420c61be79a5cf124e952fd1b24ea8eb796e6d1904bb9a3

VendorProductVersionsPlatforms

@fastify/busboy@fastify/busboy0 to < 3.2.2—