@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
The @fastify/busboy multipart form-data parser contains a prototype pollution vulnerability affecting versions 1.0.0 through 3.2.0. An attacker can crash the parser by submitting a multipart form with a part header named after a prototype-inherited property such as __proto__ or constructor. The vulnerability exists because the internal header parser stores headers in a plain JavaScript object and assumes all values are arrays. When an inherited property name is accessed, it resolves to a truthy non-array value, triggering a TypeError that causes the parser to fail. This affects any application using @fastify/busboy to handle file uploads or form submissions, potentially enabling denial-of-service attacks that disrupt service availability without requiring authentication.
While MITRE ATT&CK techniques are not formally mapped to this CVE, Casky's extended reasoning capabilities would help practitioners identify the underlying attack pattern: an attempt to manipulate object properties through malicious input. Practitioners using Casky would examine their application logs for unexpected TypeError exceptions originating from the multipart parser when processing form headers with names like __proto__, constructor, or prototype. The detection would focus on input validation gaps where user-supplied header names bypass sanitization checks. Although no specific Casky skills currently map to this vulnerability, practitioners would benefit from broader defensive strategies around secure coding practices, input validation, and secure deserialization patterns—areas where Claude's reasoning could help contextualize similar prototype-based attacks across different technologies and frameworks.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-19481. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation