facil.io versions 0.6.0 through 0.7.6 contain an infinite loop flaw in the multipart MIME body parser that arises when a multipart/form-data request ends with a partial closing boundary. The parser fails to consume any bytes and does not set a completion or error flag, causing the parent loop to repeatedly invoke the parser on the same buffer. This behaviour exhausts CPU resources, driving each worker process to 100 % utilisation and ultimately freezing all workers permanently until the server is manually restarted. The weakness is a classic CWE‑835 Infinite Loop.

The vulnerability affects all installations of facil.io from 0.6.0 up to and including 0.7.6, released by maintainer boazsegev. The impacted component is the HTTP MIME parser that processes multipart/form-data payloads.

With a CVSS score of 8.7, the flaw is classified as high severity. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog. The attack vector is an unauthenticated remote HTTP request; any external entity that can reach a facil.io worker endpoint can craft a multipart/form-data request with a malformed boundary to trigger endless CPU consumption, causing persistent denial of service across the entire server.