https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-74866.htmlhttps://patchthecve.com/cve/CVE-2026-74866.htmlFri, 16 Oct 2026 15:10:00 +0000MEDIUM 5.8: @fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into the https://patchthecve.com/cve/CVE-2026-19484.htmlhttps://patchthecve.com/cve/CVE-2026-19484.htmlThu, 03 Sep 2026 19:10:52 +0000HIGH 7.5: @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entryhttps://patchthecve.com/cve/CVE-2026-19481.htmlhttps://patchthecve.com/cve/CVE-2026-19481.htmlThu, 03 Sep 2026 19:16:01 +0000HIGH 7.5: @fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a