@NESTJS/PLATFORM-FASTIFY · GHSA-h94v-c5rc-3pxm · Package
FIX → 12.5.0
Upload interceptors in @nestjs/platform-fastify/multipart accept unlimited multipart field data sent as application/json and keep the parsed objects for the whole request. A request within default limits can exhaust the heap and terminate the process, causing denial of service.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications using the NestJS Fastify adapter with any upload interceptor from @nestjs/platform-fastify/multipart at default limits are exposed. The Express and Node adapters are not affected. No authentication is needed unless a guard protects the route.
Not affected if auth-required, express-adapter, no-multipart-uploads
Who cares fastify, nestjs, node, self-hosted
npm ls @nestjs/platform-fastify; versions >= 12.1.0 and < 12.5.0 are affected.@nestjs/platform-fastify/multipart (upload interceptors such as FileInterceptor) on routes that accept uploads.Upgrade to 12.5.0
@nestjs/platform-fastify : JSON fields are limited to 1 MiB in total by default (), and larger requests are rejected with 400.| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/platform-fastify |
| Affected versions | >= 12.1.0, < 12.5.0 |
| Patched versions | 12.5.0 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |
The upload interceptors of @nestjs/platform-fastify/multipart accepted any amount of multipart field data sent as , which is parsed into objects that are kept for the whole request. A request within the default limits could exhaust the heap and terminate the process.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
12.5.0limits.jsonFieldsSizelimits.parts and limits.fieldSize for upload routes, or limit request body sizes in a reverse proxy.application/jsonApplications using the Fastify adapter with any upload interceptor from @nestjs/platform-fastify/multipart at the default limits are affected. No authentication is needed unless a guard protects the route. The Express and Node adapters are not affected.
Fixed in 12.5.0. The JSON fields of a request are limited to 1 MiB in total by default (limits.jsonFieldsSize), and a request over the limit is rejected with 400.
Lower limits.parts and limits.fieldSize for upload routes, or limit request body sizes in a reverse proxy.
Reported by Anthropic's OSS Scanner.