PT-2023-20174 · Npm · Fastify-Multipart

Das7Pad + 1 · Published 2023-02-14 · Updated 2023-02-22 · CVE-2023-25576

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions @fastify/multipart versions prior to 6.0.1 and 7.4.1

Description The issue is related to the @fastify/multipart plugin, which may experience denial of service due to accepting an unlimited number of parts. This includes the multipart body parser accepting an unlimited number of file parts, field parts, and empty parts as field parts.

Recommendations For versions prior to 6.0.1, update to version 6.0.1 or later. For versions prior to 7.4.1, update to version 7.4.1 or later.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2023-25576

GHSA-HPP2-2CR5-PF6G

Affected Products

Fastify-Multipart

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25576.json · Exploit
• https://github.com/fastify/fastify-multipart/commit/85be81bedf5b29cfd9fe3efc30fb5a17173c1297 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-25576 · Security Note
• https://osv.dev/vulnerability/GHSA-hpp2-2cr5-pf6g · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25576 · Vendor Advisory
• https://github.com/fastify/fastify-multipart · Note
• https://github.com/fastify/fastify-multipart/releases/tag/v7.4.1 · Note
• https://github.com/fastify/fastify-multipart/releases/tag/v6.0.1 · Note
• https://github.com/fastify/fastify-multipart/security/advisories/GHSA-hpp2-2cr5-pf6g · Note
• https://hackerone.com/reports/1816195 · Note
• https://t.me/cibsecurity/58114 · Telegram Post