| Package | Affected versions | Patched versions |
|---|---|---|
| @fastify/multipart | ≥ 9.0.0, < 9.0.3< 8.3.1 | 9.0.38.3.1 |
The saveRequestFiles function does not delete the uploaded temporary files when user cancels the request.
Fixed in version 8.3.1 and 9.0.3
Do not use saveRequestFiles.
This was identified in https://github.com/fastify/fastify-multipart/issues/546 and fixed in https://github.com/fastify/fastify-multipart/pull/567.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free