-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @fastify/multipart | npm | < 6.0.1 | 6.0.1 |
| @fastify/multipart | npm | >= 7.0.0, < 7.4.1 | 7.4.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing default limits in the multipart parser configuration. The commit diff shows the addition of default values for 'parts' (1000) and 'fileSize' (bodyLimit) in the options.limits object within the fastifyMultipart function. Prior to this fix, if users didn't explicitly set these limits, the parser accepted unlimited parts. The CWE mappings (CWE-400/CWE-770) directly correlate to this lack of resource throttling. The vulnerable versions' absence of these defaults in the configuration setup made the function susceptible to DoS through excessive part processing.
A Semantic Attack on Google Gemini - Read the Latest Research