CVE-2026-74866

Medium [CVE-2026-74866] @fastify/busboy: @fastify/busboy: CRLF injection via multipart Content-Disposition filename and name

CVE-2026-74866Source published Aug 21, 2026Source updated Aug 21, 2026

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. Users should…

Affected products in this advisory

• Red Hat AMQ Broker 7
• Red Hat Ceph Storage 8
• Red Hat Ceph Storage 9
• Red Hat OpenShift AI (RHOAI)

1 more entries in the full advisory.

Source-reported affected versions

• 3.2.1

Source-reported fixed versions

• 3.2.2

Mitigation guidance

• Applications using @fastify/busboy should sanitize any multipart Content-Disposition filename and name values before reflecting them in HTTP responses or headers. Strip or reject any input containing CR (0x0D) or LF (0x0A) characters in parsed multipart field names and filenames.