CVE-2026-74866

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74866", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-08-17T10:26:26.386Z", "datePublished": "2026-08-21T08:20:32.672Z", "dateUpdated": "2026-08-21T12:37:26.259Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-08-21T08:20:32.672Z"}, "descriptions": [{"lang": "en", "value": "@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix."}]}], "affected": [{"vendor": "@fastify/busboy", "product": "@fastify/busboy", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "status": "affected", "version": "0", "lessThan": "3.2.2"}, {"versionType": "semver", "status": "unaffected", "version": "3.2.2"}], "packageURL": "pkg:npm/@fastify/busboy"}], "references": [{"url": "https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "credits": [{"lang": "en", "type": "reporter", "value": "tonghuaroot"}, {"lang": "en", "type": "remediation developer", "value": "mcollina"}, {"lang": "en", "type": "remediation reviewer", "value": "UlisesGascon"}], "title": "@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-93", "lang": "en", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')", "type": "CWE"}]}], "x_generator": {"engine": "cve-kit 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-21T12:35:38.937723Z", "id": "CVE-2026-74866", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T12:37:26.259Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74866", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-21T12:35:38.937723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-21T12:37:21.935Z"}}], "cna": {"title": "@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name", "credits": [{"lang": "en", "type": "reporter", "value": "tonghuaroot"}, {"lang": "en", "type": "remediation developer", "value": "mcollina"}, {"lang": "en", "type": "remediation reviewer", "value": "UlisesGascon"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "@fastify/busboy", "product": "@fastify/busboy", "versions": [{"status": "affected", "version": "0", "lessThan": "3.2.2", "versionType": "semver"}, {"status": "unaffected", "version": "3.2.2", "versionType": "semver"}], "packageURL": "pkg:npm/@fastify/busboy", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "cve-kit 1.0.0"}, "descriptions": [{"lang": "en", "value": "@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.", "supportingMedia": [{"type": "text/html", "value": "@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-93", "description": "CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-08-21T08:20:32.672Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74866", "state": "PUBLISHED", "dateUpdated": "2026-08-21T12:37:26.259Z", "dateReserved": "2026-08-17T10:26:26.386Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-08-21T08:20:32.672Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/@fastify/busboy", "product": "@fastify/busboy", "vendor": "@fastify/busboy", "versions": [{"lessThan": "3.2.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "3.2.2", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fastify:fastify\\/busyboy:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "A25AE22C-04F1-4E0C-88E8-95AD11012889", "versionEndExcluding": "3.2.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix."}, {"lang": "es", "value": "@fastify/busboy es un analizador de datos de formulario multipart para Node.js. Su analizador de encabezados de parte multipart divide las l\u00edneas de encabezado solo en la secuencia de dos bytes de retorno de carro y salto de l\u00ednea, por lo que un retorno de carro o salto de l\u00ednea solitario incrustado en un encabezado de parte no se trata como un salto de l\u00ednea y se transfiere textualmente al nombre de archivo y nombre de campo de Content-Disposition analizados entregados a la aplicaci\u00f3n. Un atacante que carga un archivo cuyo nombre de archivo o nombre de campo contiene un retorno de carro o salto de l\u00ednea simple puede inyectar caracteres de control en consumidores que conf\u00edan en que el analizador devuelva valores limpios, lo que permite la contaminaci\u00f3n de nombres de archivo del sistema de archivos, la falsificaci\u00f3n de registros o la inyecci\u00f3n de encabezados cuando el valor se reenv\u00eda a un sumidero sensible al retorno de carro. Todas las versiones de @fastify/busboy hasta la 3.2.1 inclusive est\u00e1n afectadas. El problema est\u00e1 solucionado en la versi\u00f3n 3.2.2, la cual rechaza cualquier l\u00ednea de encabezado que a\u00fan contenga un retorno de carro o salto de l\u00ednea simple. Los usuarios deben actualizar a la versi\u00f3n 3.2.2, y los consumidores, como @fastify/multipart, deben actualizar su dependencia de @fastify/busboy para incorporar la soluci\u00f3n."}], "id": "CVE-2026-74866", "lastModified": "2026-10-16T15:10:00.103", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74866", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-21T12:35:38.937723Z", "version": "2.0.3"}}]}, "published": "2026-08-21T09:16:40.890", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Third Party Advisory"], "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "tags": ["Vendor Advisory"], "url": "https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-93"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "@fastify/busboy: @fastify/busboy: CRLF injection via multipart Content-Disposition filename and name", "id": "2520904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520904"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the parsed Content-Disposition filename and field name handed to the application. An attacker who uploads a file whose filename or field name contains a bare carriage return or line feed can inject control characters into consumers that trust the parser to return clean values, enabling filesystem filename pollution, log forging, or header injection when the value is forwarded to a carriage-return-sensitive sink. All versions of @fastify/busboy up to and including 3.2.1 are affected. The issue is fixed in version 3.2.2, which rejects any header line that still contains a bare carriage return or line feed. Users should upgrade to 3.2.2, and consumers such as @fastify/multipart should bump their @fastify/busboy dependency to pull in the fix.", "A flaw was found in @fastify/busboy, a Node.js multipart form-data parser. The parser incorrectly handles lone carriage return or line feed characters in multipart part headers, treating them as part of the filename or field name rather than as line breaks. A remote attacker could exploit this by uploading a file with a specially crafted filename or field name, leading to control character injection. This could result in filesystem filename pollution, log forging, or header injection in applications that process these values."], "mitigation": {"lang": "en:us", "value": "Applications using @fastify/busboy should sanitize any multipart Content-Disposition filename and name values before reflecting them in HTTP responses or headers. Strip or reject any input containing CR (0x0D) or LF (0x0A) characters in parsed multipart field names and filenames."}, "name": "CVE-2026-74866", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "amq-broker-bin.zip", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "amq-broker-maven-repository.zip", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:ceph_storage:8", "fix_state": "Fix deferred", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 8"}, {"cpe": "cpe:/a:redhat:ceph_storage:9", "fix_state": "Out of support scope", "package_name": "ceph", "product_name": "Red Hat Ceph Storage 9"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-core-bff-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-dashboard-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-dashboard-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-agent-ops-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-automl-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-autorag-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-eval-hub-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-gen-ai-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-maas-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-mlflow-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mod-arch-model-registry-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift4/ose-console-rhel9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "wasmedge", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-21T08:20:32Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74866\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74866\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9"], "statement": "A flaw was found in @fastify/busboy. The library does not sanitize CRLF sequences in multipart Content-Disposition filename and name fields. An attacker can inject CRLF characters into multipart form data, which may be passed through to downstream HTTP responses or headers if the application reflects the parsed filename or name values without additional sanitization, potentially enabling HTTP response splitting or header injection.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.2.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "@fastify/busboy", "source": "cna", "vendor": "@fastify/busboy"}, "product": "busboy", "vendor": "fastify"}], "created": "2026-08-21T10:15:13.767860+00:00", "updated": "2026-08-21T12:08:01.484480+00:00", "vendors": ["fastify", "fastify$PRODUCT$busboy"]}