Uncontrolled Resource Consumption in fastify-multipart

HIGH 7.5CVE-2020-8136 · GHSA-p9f8-gqjf-m75j · Published 20/03/2020 · updated 17/06/2026

In short

CVE-2020-8136 is a HIGH (CVSS 7.5) vulnerability affecting fastify-multipart (fastify), fastify-multipart.
Chance of exploitation in the next 30 days (EPSS): 1.5%, higher than 74.2% of all vulnerabilities.
Fix: update to 1.0.5 or later.

Package	Affected versions	Patched versions
fastify-multipart fastify	`< 1.0.5`	`1.0.5`
fastify-multipart npm	`< 1.0.5`	`1.0.5`

Description

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.

NVD description

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.

References

nvd.nist.gov/vuln/detail/CVE-2020-8136 · ADVISORY
hackerone.com/reports/804772 · WEB

More vulnerabilities in fastify-multipart

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

fastify-multipart

fastify

< 1.0.5

1.0.5

fastify-multipart

npm

< 1.0.5

1.0.5

Description

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.

NVD description

Prototype pollution vulnerability in fastify-multipart < 1.0.5 allows an attacker to crash fastify applications parsing multipart requests by sending a specially crafted request.

More vulnerabilities in fastify-multipart

See all →