CVE-2026-74866 is a medium-severity (CVSS 5.8) CWE-93 vulnerability in @fastify/busboy. A fix is available for @fastify/busboy — see the affected versions and patch details below.
@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-74866.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-74866 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,415 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
@fastify/busboyReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects npm packages — download data is not available via public APIs for these ecosystems.
Description
Impact
@fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is carried verbatim into the filename and field name delivered by the file and field events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character.
An attacker who uploads a file whose filename or field name contains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using @fastify/busboy directly, or through @fastify/multipart and its consumers, are affected.
Patches
Upgrade to @fastify/busboy 3.2.2 or later.
Workarounds
Validate or strip carriage return and line feed characters from the filename and field name before using them in any filesystem, logging, or outbound-header context.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | @fastify/busboy | all versions | 3.2.2npm install @fastify/busboy@3.2.2 |
Affected Products
fastify\/busyboyfastifyDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for @fastify/busboy, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update @fastify/busboy to 3.2.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-74866 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
A flaw was found in @fastify/busboy. The library does not sanitize CRLF sequences in multipart Content-Disposition filename and name fields. An attacker can inject CRLF characters into multipart form data, which may be passed through to downstream HTTP responses or headers if the application reflects the parsed…
Applications using @fastify/busboy should sanitize any multipart Content-Disposition filename and name values before reflecting them in HTTP responses or headers. Strip or reject any input containing CR (0x0D) or LF (0x0A) characters in parsed multipart field names and filenames.Source: Red Hat security advisory for CVE-2026-74866 (CC BY 4.0)
Frequently Asked Questions
Is CVE-2026-74866 in your dependencies?
Find it across npm, including transitive dependencies.