A remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to exactly 252 bytes. This boundary length causes the library’s skip table to zero out, turning a normally efficient search into a CPU‑bound loop that keeps one core busy. The result is a denial of service against all other requests handled by the same process. The weakness stems from improper boundary validation (CWE‑1322) and results in an infinite loop condition (CWE‑835).

The vulnerability affects the @fastify/busboy multipart parser in versions 3.1.0 through 3.2.0. Users running these versions should upgrade to 3.2.1, which expands the skip table to preserve the skip distance and eliminate the loop.

The CVSS score of 7.5 indicates a high impact denial of service. Although the EPSS score is not available, the flaw is remotely exploitable by sending a specifically crafted request, meaning attackers can target exposed services without authentication. The flaw is not yet listed in CISA’s KEV catalog, but the straightforward attack path and the severity of the effect warrant prompt remediation.