The @fastify/busboy package versions >=3.1.0 and <3.2.1 contain a denial of service vulnerability due to improper handling of multipart boundaries. The internal streaming multipart search uses a Uint8Array(256) to store skip distances. When a multipart boundary of exactly 252 bytes is used, the search needle becomes 256 bytes, causing the table entry to wrap to zero. This results in an infinite CPU-bound loop that stalls the Node.js event loop, allowing an unauthenticated attacker to cause a denial of service with a single crafted multipart/form-data request. Applications using @fastify/busboy directly or via @fastify/multipart are affected. The vulnerability is tracked as CVE-2026-19484 and has a CVSS 3.1 score of 7.5 (high severity).

An unauthenticated attacker can cause a denial of service by sending a specially crafted multipart/form-data request with an oversized multipart boundary. This stalls the Node.js event loop, effectively making the application unresponsive. There is no impact on confidentiality or integrity reported.

Upgrade @fastify/busboy to version 3.2.1 or later, where the vulnerability is fixed. Alternatively, validate the multipart boundary length before parsing and reject any boundary longer than 70 characters (the RFC 2046 limit), for example at a reverse proxy or in an onRequest hook. Upgrading removes the issue entirely.