@fastify/busboy is a multipart form-data parser that incorrectly handles header names that are inheritable properties, such as __proto__ or constructor. When an attacker submits a multipart request containing such a header, the internal header parser stores data in a plain JavaScript object and expects array values. The inherited property resolves to a truthy non-array value, causing a TypeError. In the stream-pipe integration the error is emitted as an event, but when the parser is used directly in a write or end call the exception is thrown synchronously and can terminate the Node.js process, resulting in an unauthenticated denial of service. This weakness is represented by CWE-754 and CWE-915.

The affected software is the @fastify/busboy multipart form-data parser used in Node.js applications. All released versions from 1.0.0 through 3.2.0 are vulnerable. Version 3.2.1 and later contain the fix that replaces the header object with a null prototype. Applications that depend on any unpatched version of @fastify/busboy are at risk.

The CVSS v3 base score is 7.5, indicating a high severity denial of service condition. An attacker can trigger the vulnerability by crafting and sending a multipart/form-data HTTP request that includes a header name such as __proto__ or constructor. Since no authentication is required, potentially any external user who can reach the endpoint can cause it, and the exploit would terminate the Node.js process when busboy is used directly with write or end. The EPSS score is 0.278%, and the vulnerability is not listed in the CISA KEV catalog, so no public exploit is known, but the possibility of an untrapped exception makes it a high concern for availability. The crash results only in service interruption with no remote code execution potential.