@fastify/multipart, the multipart form‑data and file upload plugin for the Fastify web framework, fails to propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary. In affected versions 5.3.0 through 10.1.6, the plugin silently destroys the in‑progress file stream without emitting an error or end event. This causes request handlers that iterate the request parts and perform asynchronous work before consuming the file to hang indefinitely, resulting in requests that never respond and keep the connection open. The impact is purely availability, as the attacker can repeatedly send malformed uploads to accumulate pending connections and exhaust server resources.

The vulnerability affects the @fastify/multipart package in Fastify applications. Versions 5.3.0 through 10.1.6 are vulnerable; version 10.1.7 and later contain the fix that propagates the parser error, terminating delayed consumers with an error instead of hanging. All Fastify applications that use this plugin are at risk if their upload handling logic includes delayed file consumers or if the package is not updated.

The CVSS score is 5.9, indicating a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an unauthenticated remote client to send malformed uploads against a route that uses delayed file consumption. If such application logic is present, an attacker can accumulate pending connections and exhaust server resources. The path to exploitation is straightforward: craft a multipart request with an incomplete boundary while the Content‑Length is satisfied, then repeat the request to drain available server connections. The effect is a denial of service that persists until the server is restarted or the attack is mitigated.