Inadequate file size control In @fastify/multipart
Description
Unlimited consumption of resources in @fastify/multipart
Impact
The saveRequestFiles function does not delete the uploaded temporary files when user cancels the request.
Patches
Fixed in version 8.3.1 and 9.0.3
Workarounds
Do not use saveRequestFiles.
References
This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 8.3.1, 9.0.3 |
Aliases
1. 2. 3. 4. 5.
References
1. 2. 3.