A logic error in @fastify/multipart causes the plugin to drop its internal reference to a file stream when the busboy fileSize limit is reached. If the client aborts the connection before the terminating boundary arrives, the abort handler finds no active stream to destroy, leaving the saveRequestFiles promise unsettled. The request handler then hangs indefinitely while a temporary file already written to disk is never removed. An attacker can trigger this repeatedly to exhaust disk space and tie up the event loop, resulting in denial of service. The weakness is an instance of uncontrolled resource consumption (CWE‑400) and improper handling of asynchronous operations (CWE‑664).

Fastify applications that use the @fastify/multipart plugin in versions from 5.3.0 up to but not including 10.1.1 are affected. Any deployment of Fastify that imports this package is potentially vulnerable unless a newer version is used.

The CVSS score of 7.5 indicates high severity. Exploitation requires only an unauthenticated client that can send multipart file uploads and abort the connection. The attack vector is likely network‑based, using HTTP POST requests. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploitation yet, but the possibility of rapid, automated abuse exists. Given the impact on disk and event‑loop resources, the risk to availability is significant.