The multipart header parser in @fastify/busboy stores part-header names on a plain JavaScript object. If a multipart part header is named '__proto__' or 'constructor', it resolves to an inherited prototype value rather than an array, causing a TypeError when the parser attempts to push to it. This error surfaces as an 'error' event in the documented req.pipe(busboy) integration or throws synchronously during direct write()/end() calls, potentially terminating the Node.js process if uncaught. The parser runs before application middleware, allowing any unauthenticated client submitting multipart/form-data to trigger the denial of service. The vulnerability is fixed in version 3.2.1.

An attacker can cause a denial of service by sending specially crafted multipart/form-data requests with headers named '__proto__' or 'constructor'. This triggers a TypeError in the parser, which can crash the Node.js process if the error is not properly handled. The vulnerability affects all users of @fastify/busboy versions >=1.0.0 and <3.2.1, potentially leading to service outages.

Upgrade @fastify/busboy to version 3.2.1 or later to fully resolve the issue. As a workaround, attach an 'error' event listener to the Busboy stream to handle parser failures gracefully and wrap direct write()/end() calls in try/catch blocks to prevent process termination. However, upgrading is the recommended and complete fix.