A high-severity resource consumption vulnerability in @fastify/multipart allows remote, unauthenticated attackers to trigger denial of service conditions.

The library exhibits uncontrolled resource consumption (CWE-400) and improper control of resource lifetime (CWE-664), where specifically crafted multipart requests can exhaust system resources.

Assigned a CVSS score of 7.5, this vulnerability poses a significant risk to service availability. By exhausting server memory or CPU through malformed requests, an attacker can effectively disable the application, leading to service downtime and negative impacts on business operations.

Immediate Action: Update the @fastify/multipart dependency to version 10.1.1 or later.

Proactive Monitoring: Monitor server resource utilization (CPU and Memory) and log error rates related to request parsing or timeout events.

Compensating Controls: Implement strict request size limits and timeout configurations at the gateway or load balancer level to mitigate the impact of resource-exhaustion attacks.

Public Exploit Available: No

Given the potential for denial of service, developers should prioritize upgrading the @fastify/multipart library. Ensuring that the application is resilient against malformed input is essential to maintaining high availability and protecting the underlying server infrastructure from resource exhaustion.