High [CVE-2026-19481] Denial of Service from crafted form-data headers

@fastify/busboy is a multipart form-data parser. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError.

In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype.

Users should upgrade to 3.2.1. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers.

This can cause a TypeError in the parser, leading to the termination of the Node.js process and resulting in an unauthenticated Denial of Service (DoS). The unauthenticated nature and potential for service disruption elevate the impact to Important.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-915.

Affected Red Hat products: OpenShift Pipelines; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat AMQ Broker 7; Red Hat OpenShift Container Platform 4 as not affected.

Red Hat does not currently list a fixing RHSA for this CVE.