@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-19484 is a denial-of-service vulnerability in @fastify/busboy versions 3.1.0 through 3.2.0 that allows unauthenticated attackers to stall the Node.js event loop through crafted multipart form-data requests. The vulnerability exploits a fixed 256-entry byte array used for skip table optimization in the streaming search algorithm. By sending a multipart request with a boundary exactly 252 bytes long, an attacker forces the search needle to 256 bytes, causing the skip distance to truncate to zero. This transforms the boundary-matching algorithm from an efficient search into a CPU-bound infinite loop, consuming event loop resources and rendering the application unresponsive. Any web application using @fastify/busboy for file uploads or form processing is vulnerable, making this a critical concern for Node.js-based services handling user-submitted content.
While Casky.ai currently shows zero matching skills for this specific vulnerability, practitioners using the platform would benefit from extended reasoning capabilities to correlate attack patterns with CWE-835 (infinite loop) and CWE-1322 (unsynchronized data access) signatures. A security team monitoring this threat would look for HTTP POST/PUT requests with Content-Type: multipart/form-data containing unusually large boundary delimiters (252+ bytes), coupled with sudden spikes in CPU utilization and event loop lag metrics. Although no MITRE ATT&ACK techniques are currently mapped, this attack aligns with resource exhaustion tactics (T1499) under the Impact tactic. Practitioners should focus detection rules on malformed multipart boundaries and implement rate limiting on file upload endpoints as immediate mitigations while patching to version 3.2.1 or later.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-19484. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation