@fastify/busboy parses multipart form-data headers by splitting only on the two‑byte CRLF sequence. When a header line contains a lone carriage return or line feed, it is not treated as a line break and is carried verbatim into the parsed Content‑Disposition filename or field name. This flaw allows an attacker to upload a file whose name or form field contains a bare carriage return or line feed, injecting arbitrary control characters into values that the application later trusts. The result can be filesystem filename pollution, log forging, or injection into HTTP headers, compromising data integrity or leading to further exploitation.

All versions of @fastify/busboy up to and including 3.2.1 are vulnerable. The fix is provided in 3.2.2 which rejects header lines containing bare CR or LF characters. Users of @fastify/busboy and dependent projects such as @fastify/multipart should update to 3.2.2 or a later release.

The CVSS score of 5.8 indicates moderate risk. The EPSS score is not available, so the likelihood of exploitation is uncertain. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to craft a multipart request with a filename or field name that includes CR or LF; if the application forwards these unvalidated values to vulnerable sinks, the consequences can include file system corruption or log tampering.