CVE-2026-19484: Remote Denial of Service via Boyer-Moore-Horspool Integer Wrap-around in @fastify/busboy

The @fastify/busboy library is a standard streaming parser designed to process multipart/form-data payloads in Node.js applications. This parser handles incoming file uploads and form fields in a non-blocking stream, making it highly critical for APIs accepting file inputs. Because Node.js utilizes a single-threaded architecture, any blocking or CPU-bound computation in core parsing dependencies impacts the scalability of the entire host application.

CVE-2026-19484 represents an algorithmic denial of service vulnerability in the Boyer-Moore-Horspool string search algorithm utilized within the library's streamsearch submodule. When processing specially crafted multipart headers, the parser is forced into an infinite loop, stalling the Node.js event loop completely. This vulnerability allows an unauthenticated, remote attacker to starve application resources by sending a single, minimal request.

Because the underlying event loop is blocked, the server becomes incapable of accepting new TCP connections or processing outstanding requests. The impact remains isolated to the availability of the host service, meaning confidentiality and integrity are not compromised, though service restoration requires manual intervention or an automated process restart.

The core defect resides within deps/streamsearch/sbmh.js, which implements the Boyer-Moore-Horspool string search algorithm for pattern matching against multipart boundaries. This algorithm precomputes a bad-character shift table (known as the occurrence table) that defines how far the window can shift forward when a character mismatch occurs. The default shift distance for mismatching characters is designated as the length of the needle pattern itself.

In the vulnerable implementation, the occurrence table is backed by a Uint8Array of size 256. When a multipart boundary of exactly 252 bytes is supplied, the library prepends standard formatting delimiters, expanding the needle pattern to exactly 256 bytes. When initialization code attempts to populate the occurrence table using the .fill(256) method, an 8-bit integer wrap-around occurs because the maximum value for a Uint8Array element is 255.

Consequently, the value 256 overflows to 0 inside the array elements ($256 \pmod{256} = 0$). Any mismatch on a byte mapped to these zeroed entries instructs the search algorithm to advance the matching window by exactly 0 bytes. This creates a loop with an unreachable exit condition (CWE-835), forcing the single-threaded Node.js event loop to execute the identical comparison at the same offset perpetually.

The vulnerability was remediated in commit 632a237e7fb6b3b7a30e0de8fab2ee72ca5bf722 by altering the storage representation of the occurrence table. The patch changes the backing array of the table from an 8-bit unsigned integer array to a 16-bit unsigned integer array, raising the maximum boundary capacity significantly.

Below is the comparison of the vulnerable and patched versions of deps/streamsearch/sbmh.js showing how the shift distances are calculated:

// Vulnerable Implementation (v3.1.0 - v3.2.0)
function SBMH (needle) {
  this.maxMatches = Infinity
  this.matches = 0
 
  // BUG: Uint8Array(256) cannot store values >= 256.
  // A needle length of 256 wraps down to 0, neutralizing shift distances.
  this._occ = new Uint8Array(256).fill(needleLength)
  this._lookbehind_size = 0
  this._needle = needle
}

// Patched Implementation (v3.2.1)
function SBMH (needle) {
  this.maxMatches = Infinity
  this.matches = 0
 
  // FIX: Widening the backing store to Uint16Array prevents the wrap-around.
  // This array can safely hold needle lengths up to 65,535.
  this._occ = new Uint16Array(256).fill(needleLength)
  this._lookbehind_size = 0
  this._needle = needle
}

While this fix successfully resolves the integer overflow for needle sizes below 65,536 bytes, a boundary constraint assessment reveals that theoretical overflows could still exist if an application permitted needles longer than 65,535 bytes. However, HTTP header length limitations and typical buffer limits in Node.js platforms restrict practical boundary lengths well below this threshold. Thus, the patch is highly effective for realistic operational environments.

Exploiting this flaw is simple and requires no specialized privileges, authentication, or sequence of API calls. The attacker needs only to send a single HTTP POST request containing a crafted multipart boundary parameter in the Content-Type header. The target application must be configured to process incoming form data using an affected version of the @fastify/busboy module.

To construct the payload, the attacker crafts a string of exactly 252 characters to act as the boundary parameter. When the server processes this header, it adds standard multipart syntax wrappers (specifically prepending -- characters), bringing the internal search needle size to exactly 256 bytes. When the client begins streaming the request body, the parsing engine triggers the matching logic against the input data.

As shown in the flow diagram, the calculation of a zero shift distance blocks all processing progress. The application stays trapped inside the execution loop, consuming 100% of the allocated CPU core resources and remaining unresponsive to any network traffic.

The primary security consequence of CVE-2026-19484 is complete application-level Denial of Service (DoS). Since Node.js handles incoming I/O operations and database queries on a single-threaded event loop, stalling this thread prevents any other asynchronous callbacks or requests from executing. As a result, a single malicious HTTP request can compromise the availability of an entire application process.

If the application is deployed behind a load balancer without health check-based autoscaling, a sustained attack consisting of few requests can disable the entire application tier. If the server is configured to automatically restart upon crash, this flaw poses an even greater disruption, as it does not trigger an actual process crash (segmentation fault or unhandled exception). Instead, the process remains running indefinitely in a hung state, rendering passive process monitoring tools ineffective.

This vulnerability is tracked with a CVSS v3.1 score of 7.5, classifying it as High severity. The low attack complexity, combined with the lack of authentication or user interaction requirements, elevates the threat profile for high-traffic endpoints that expose file-upload functionalities to the public internet.

The primary mitigation action is to upgrade @fastify/busboy to version 3.2.1 or higher. For applications using umbrella frameworks or dependency injectors that bundle busboy transitively, dependency resolution overrides should be declared within the package lockfiles (e.g., using NPM overrides or Yarn resolutions) to force the usage of the patched version.

If immediate dependency upgrades are not feasible, network-level mitigations should be implemented. According to RFC 2046 Section 5.1.1, multipart boundaries should not exceed 70 characters in length. Security teams can configure Web Application Firewalls (WAFs) or reverse proxies to inspect the Content-Type header and drop any request containing a boundary parameter length that exceeds this standard threshold.

# Example Nginx configuration block to inspect boundary length
if ($http_content_type ~* "boundary=[a-zA-Z0-9'\(\)\+,\-\./:=\?]{71,}") {
    return 400 "Bad Request: Boundary length exceeds RFC 2046 limits.";
}

Additionally, implementing application-level timeouts and monitoring CPU utilization anomalies can help identify and isolate stalled processes. However, these runtime defensive measures should complement, rather than substitute, the library update to 3.2.1.