What is GHSA-27c6-mcxv-x3fh?

GHSA-27c6-mcxv-x3fh is a security advisory published by GitHub Security Advisories with High severity. Unlimited consumption of resources in @fastify/multipart

Which CVE IDs does GHSA-27c6-mcxv-x3fh cover?

GHSA-27c6-mcxv-x3fh covers the following CVE IDs: CVE-2025-24033. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-27c6-mcxv-x3fh?

GHSA-27c6-mcxv-x3fh has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-27c6-mcxv-x3fh?

GHSA-27c6-mcxv-x3fh affects 2 products, including: npm/@fastify/multipart:\u003c= 8.3.0; npm/@fastify/multipart:\u003e= 9.0.0, \u003c 9.0.3.

GHSA-27c6-mcxv-x3fhHighCVSS 7.5

Unlimited consumption of resources in @fastify/multipart

Vendor

GitHub Security Advisories

Published

January 23, 2025

Last Modified

January 23, 2025

🔗 CVE IDs covered (1)

CVE-2025-24033 →

📋 Description

Impact

The saveRequestFiles function does not delete the uploaded temporary files when user cancels the request.

Patches

Fixed in version 8.3.1 and 9.0.3

Workarounds

Do not use saveRequestFiles.

References

This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.

🎯 Affected products2

npm/@fastify/multipart:<= 8.3.0
npm/@fastify/multipart:>= 9.0.0, < 9.0.3

🔗 References (5)

https://github.com/fastify/fastify-multipart/security/advisories/GHSA-27c6-mcxv-x3fh
https://github.com/fastify/fastify-multipart/issues/546
https://github.com/fastify/fastify-multipart/pull/567
https://nvd.nist.gov/vuln/detail/CVE-2025-24033
https://github.com/advisories/GHSA-27c6-mcxv-x3fh