@fastify/multipart is a multipart form‑data parser used within Fastify applications. In versions 3.0.0 through 10.1.0, the request.saveRequestFiles() function may leave temporary file data on disk when an upload is aborted while the parser moves between parts. The cleanup logic that normally removes completed files is bypassed, allowing an unauthenticated client to repeatedly disconnect during uploads and force the accumulation of temporary files on the target system’s storage, ultimately exhausting available disk space and resulting in a denial of service condition.

All installations of @fastify/multipart from version 3.0.0 up to, but excluding, 10.1.1 are affected. No specific operating system or deployment configuration is mentioned, so any environment running this library is vulnerable if the unpatched range of versions is in use.

The vulnerability receives a CVSS score of 7.5 and is not listed in the CISA KEV catalog. EPSS information is unavailable, indicating that exploitation data are not currently measured. The likely attack vector is an unauthenticated HTTP client sending multipart/form‑data uploads and abruptly closing the connection before the request is fully processed. Because the flaw allows an attacker to consume linear disk space over time, the risk escalation is significant for services with high traffic or limited storage capacity.