A resource exhaustion vulnerability in @fastify/multipart allows unauthenticated remote attackers to cause a denial of service via malformed multipart requests.

This issue involves incomplete resource cleanup and lack of throttling mechanisms (CWE-459 and CWE-770) during file uploads. An unauthenticated attacker can exploit this by sending specially crafted requests that consume excessive server memory or CPU.

The vulnerability carries a CVSS score of 7.5, indicating a high severity due to the ease of exploitation. Successful exploitation results in system instability or a complete denial of service, which can cause significant operational downtime for applications relying on this library for file processing.

Immediate Action: Update the @fastify/multipart package to version 10.1.1 or later to implement proper resource limits and cleanup logic.

Proactive Monitoring: Monitor server memory and CPU utilization for sudden, sustained spikes that coincide with multipart form-data requests.

Compensating Controls: Implement strict request size limits and timeout configurations at the Web Application Firewall or reverse proxy level to drop excessively large or slow-processing requests.

Public Exploit Available: Unknown

Given the high CVSS score and the potential for service disruption, administrators should prioritize updating the vulnerable package immediately. Ensuring that the application environment enforces strict resource constraints is essential to minimizing the impact of similar parsing vulnerabilities.