CVE-2026-19481
HighAdvisory
Published 2 Oct 2026In the index since 3 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 7.5
- base score, highest
- EPSS
- 0.005
- 40th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 52
- of 18,026 indexed, latest versions
- Container images
- 49
- deployed by those charts
- Fix available
- 1 of 1
- affected package
@fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header
Carried by container images the latest versions of 52 of 18,026 indexed charts deploy, on 49 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| @fastify/ | 1.0.0, 1.1.0, 1.2.1, 2.0.0+4 more | 3.2.1 | 49 |
- OSV records
- GHSA-x8mw-p69m-v3mx
Charts affected
52 by stars
Container images carrying it
49 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| quay.io/ | 709c7da19c5a | @fastify/ | 3.2.1 | 3 |
| ethersphere/ | 0558799ca992 | @fastify/ | 3.2.1 | 2 |
| freikin/ | e58334ca5697 | @fastify/ | 3.2.1 | 2 |
| gjeanmart/ | 926264c8f2d1 | @fastify/ | 3.2.1 | 2 |
| activepieces/ | a12efde0c535 | @fastify/ | 3.2.1 | 1 |
| activepieces/ | c26188b44e62 | @fastify/ | 3.2.1 | 1 |
| aktosecurity/ | 853e37321e6e | @fastify/ | 3.2.1 | 1 |
| camptocamp/ | ae874f70cc16 | @fastify/ | 3.2.1 | 1 |
| catalysm/ | e8e3d06f1d70 | @fastify/ | 3.2.1 | 1 |
| countly/ | f4cc7447c4f5 | @fastify/ | 3.2.1 | 1 |
| countly/ | e3c238248f99 | @fastify/ | 3.2.1 | 1 |
| countly/ | 2acbc11499b6 | @fastify/ | 3.2.1 | 1 |
| cspconsole/ | 9a2d8840bfdf | @fastify/ | 3.2.1 | 1 |
| docmost/ | b56947fcfd08 | @fastify/ | 3.2.1 | 1 |
| globalping/ | b8469caf783a | @fastify/ | 3.2.1 | 1 |
| haohanyang/ | 54f2112602ee | @fastify/ | 3.2.1 | 1 |
| hirosystems/ | 9c98b23c1515 | @fastify/ | 3.2.1 | 1 |
| infisical/ | 3365445909be | @fastify/ | 3.2.1 | 1 |
| infisical/ | 6b911e3938ac | @fastify/ | 3.2.1 | 1 |
| jupyterhub/ | 3974ba945e65 | @fastify/ | 3.2.1 | 1 |
| n8nio/ | 8b39ed5a2de9 | @fastify/ | 3.2.1 | 1 |
| n8nio/ | dd171d45102a | @fastify/ | 3.2.1 | 1 |
| opea/ | 2bee4eb66f3e | @fastify/ | 3.2.1 | 1 |
| openhab/ | bfd4a60e90da | @fastify/ | 3.2.1 | 1 |
| openhab/ | 29dd2bac8c4b | @fastify/ | 3.2.1 | 1 |
| oznu/ | 2e12d0e2dcce | @fastify/ | 3.2.1 | 1 |
| speckle/ | 49d10dcdfb91 | @fastify/ | 3.2.1 | 1 |
| speckle/ | 4b6a0750d5aa | @fastify/ | 3.2.1 | 1 |
| speckle/ | 52f8eabf5cea | @fastify/ | 3.2.1 | 1 |
| speckle/ | 687f43ab16f3 | @fastify/ | 3.2.1 | 1 |
| speckle/ | 75cdf256067b | @fastify/ | 3.2.1 | 1 |
| speckle/ | 79f14a2bf931 | @fastify/ | 3.2.1 | 1 |
| speckle/ | 89a5872375f9 | @fastify/ | 3.2.1 | 1 |
| speckle/ | 8fd157733393 | @fastify/ | 3.2.1 | 1 |
| speckle/ | bf6a501b2210 | @fastify/ | 3.2.1 | 1 |
| speckle/ | e8413f57b327 | @fastify/ | 3.2.1 | 1 |
| supabase/ | 5fea789899d4 | @fastify/ | 3.2.1 | 1 |
| supabase/ | c8eb9858eafe | @fastify/ | 3.2.1 | 1 |
| supabase/ | f983fb50bd95 | @fastify/ | 3.2.1 | 1 |
| veecode/ | 881f936ff4a3 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | 5889bea38e56 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | c739b74dabb0 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | 4ddbb244c82f | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | 65463e02f887 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | 2a7da1451f86 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | ff2af53897e7 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | 0708d30433d4 | @fastify/ | 3.2.1 | 1 |
| ghcr.io/ | 49800ff775f3 | @fastify/ | 3.2.1 | 1 |
| quay.io/ | 56399619568b | @fastify/ | 3.2.1 | 1 |