Impact
@fastify/busboy 3.2.1 and earlier retains a bare carriage return or line feed inside the parsed Content-Disposition parameters returned to the application. The multipart header parser ends a header line only on the two-byte \r\n sequence, so a lone CR or LF embedded in a part header is carried verbatim into the filename and field name delivered by the file and field events. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character.
An attacker who uploads a file whose filename or field name contains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using @fastify/busboy directly, or through @fastify/multipart and its consumers, are affected.
Patches
Upgrade to @fastify/busboy 3.2.2 or later.
Workarounds
Validate or strip carriage return and line feed characters from the filename and field name before using them in any filesystem, logging, or outbound-header context.
References
tonghuaroot Reporter
mcollina Remediation developer
UlisesGascon Remediation reviewer
Impact
@fastify/busboy3.2.1 and earlier retains a bare carriage return or line feed inside the parsedContent-Dispositionparameters returned to the application. The multipart header parser ends a header line only on the two-byte\r\nsequence, so a lone CR or LF embedded in a part header is carried verbatim into thefilenameand fieldnamedelivered by thefileandfieldevents. An application that forwards the supplied filename or name into a CR/LF-sensitive sink cannot anticipate the embedded control character.An attacker who uploads a file whose
filenameor fieldnamecontains a bare CR or LF can pollute filenames on disk when the upload is saved under its original name, inject forged lines into logs, or inject headers on a downstream hop that does not re-validate CR/LF, such as object-storage metadata or a proxied backend. Applications using@fastify/busboydirectly, or through@fastify/multipartand its consumers, are affected.Patches
Upgrade to
@fastify/busboy3.2.2 or later.Workarounds
Validate or strip carriage return and line feed characters from the
filenameand fieldnamebefore using them in any filesystem, logging, or outbound-header context.References