{"id":"GHSA-h94v-c5rc-3pxm","kind":"vulnerability","aliases":["GHSA-h94v-c5rc-3pxm"],"related":[],"title":"Process crash via multipart fields parsed as JSON on the Fastify adapter","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/platform-fastify` |\n| Affected versions | `>= 12.1.0, < 12.5.0` |\n| Patched versions | `12.5.0` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (7.5) |\n| CWE | CWE-770 (Allocation of Resources Without Limits or Throttling), CWE-400 (Uncontrolled Resource Consumption) |\n\n### Summary\n\nThe upload interceptors of `@nestjs/platform-fastify/multipart` accepted any amount of multipart field data sent as `application/json`, which is parsed into objects that are kept for the whole request. A request within the default limits could exhaust the heap and terminate the process.\n\n### Impact\n\nApplications using the Fastify adapter with any upload interceptor from `@nestjs/platform-fastify/multipart` at the default limits are affected. No authentication is needed unless a guard protects the route. The Express and Node adapters are not affected.\n\n### Patches\n\nFixed in **12.5.0**. The JSON fields of a request are limited to 1 MiB in total by default (`limits.jsonFieldsSize`), and a request over the limit is rejected with 400.\n\n### Workarounds\n\nLower `limits.parts` and `limits.fieldSize` for upload routes, or limit request body sizes in a reverse proxy.\n\n### Credit\n\nReported by Anthropic's OSS Scanner.","summary":"Upload interceptors in @nestjs/platform-fastify/multipart accept unlimited multipart field data sent as application/json and keep the parsed objects for the whole request. A request within default limits can exhaust the heap and terminate the process, causing denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/platform-fastify","fixed":["12.5.0"],"affected":">= 12.1.0, < 12.5.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","cwe-770","fastify","nestjs","node","package","self-hosted"],"not_affected_if":["auth-required","express-adapter","no-multipart-uploads"],"how_to_check":"- Check the installed version with `npm ls @nestjs/platform-fastify`; versions `>= 12.1.0` and `< 12.5.0` are affected.\n- Look for imports from `@nestjs/platform-fastify/multipart` (upload interceptors such as FileInterceptor) on routes that accept uploads.","fix":"- `@nestjs/platform-fastify` `12.5.0`: JSON fields are limited to 1 MiB in total by default (`limits.jsonFieldsSize`), and larger requests are rejected with 400.\n- Workaround from the advisory: lower `limits.parts` and `limits.fieldSize` for upload routes, or limit request body sizes in a reverse proxy.","status":"open","published_at":"2026-11-12T19:03:56+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","triaged_at":"2026-11-12T19:15:44+00:00","updated_at":"2026-11-12T19:15:44+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-12T19:15:44Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/platform-fastify` `12.5.0`: JSON fields are limited to 1 MiB in total by default (`limits.jsonFieldsSize`), and larger requests are rejected with 400.\n- Workaround from the advisory: lower `limits.parts` and `limits.fieldSize` for upload routes, or limit request body sizes in a reverse proxy.","reach":"internet","title":"NestJS Fastify adapter: multipart JSON fields can crash the Node process","impact":"medium","summary":"Upload interceptors in @nestjs/platform-fastify/multipart accept unlimited multipart field data sent as application/json and keep the parsed objects for the whole request. A request within default limits can exhaust the heap and terminate the process, causing denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","node","fastify","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Remote request crashes the Node process, causing denial of service.","analyst_note":"Product: npm:@nestjs/platform-fastify; `ghsa-repo` advisory only.","how_to_check":"- Check the installed version with `npm ls @nestjs/platform-fastify`; versions `>= 12.1.0` and `< 12.5.0` are affected.\n- Look for imports from `@nestjs/platform-fastify/multipart` (upload interceptors such as FileInterceptor) on routes that accept uploads.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["express-adapter","no-multipart-uploads","auth-required"],"who_is_affected":"Applications using the NestJS Fastify adapter with any upload interceptor from @nestjs/platform-fastify/multipart at default limits are exposed. The Express and Node adapters are not affected. No authentication is needed unless a guard protects the route.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000854,"input_tokens":5068,"output_tokens":694,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':25B,111C '-770':27B,102C '1':206C '12.1.0':81C '12.5.0':82C,85C,196C '3pxm':17A,22A '400':222C '7.5':99C 'accept':39B,121C 'adapt':12A,162C,189C 'affect':79C,174C,192C 'alloc':103C 'amount':123C 'anthrop':243C 'applic':158C 'application/json':46B,130C 'authent':176C 'av':90C 'bodi':234C 'c5rc':16A,21A 'caus':69B 'consumpt':114C 'could':149C 'crash':2A 'credit':240C 'cvss':88C 'cwe':24B,26B,100C,101C,110C 'data':43B,127C 'default':59B,147C,171C,211C 'denial':70B 'ecosystem':75C 'exhaust':62B,150C 'express':186C 'fastifi':11A,28B,161C 'field':5A,42B,73C,126C,199C 'fix':194C 'ghsa':14A,19A 'ghsa-h94v-c5rc-3pxm':13A,18A 'guard':181C 'h':98C 'h94v':15A,20A 'heap':64B,152C 'high':87C 'host':34B 'impact':157C 'interceptor':36B,118C,166C 'json':8A,198C 'keep':48B 'kept':138C 'l/pr':92C 'limit':60B,107C,148C,172C,204C,218C,232C 'limits.fieldsize':227C 'limits.jsonfieldssize':212C 'limits.parts':225C 'lower':224C 'mib':207C 'multipart':4A,41B,125C 'n/a':97C 'n/ac':91C 'n/i':96C 'n/s':94C 'n/ui':93C 'need':178C 'nestj':29B 'nestjs/platform-fastify':23A,78C 'nestjs/platform-fastify/multipart':38B,120C,168C 'node':30B,188C 'npm':76C 'object':51B,135C 'oss':245C 'packag':31B,77C 'pars':6A,50B,133C 'patch':83C,193C 'process':1A,68B,156C 'protect':182C 'proxi':239C 'reject':220C 'report':241C 'request':55B,57B,142C,144C,202C,215C,233C 'resourc':105C,113C 'revers':238C 'rout':184C,230C 'scanner':246C 'self':33B 'self-host':32B 'sent':44B,128C 'servic':72B 'sever':86C 'size':235C 'summari':115C 'termin':66B,154C 'throttl':109C 'total':209C 'u/c':95C 'uncontrol':112C 'unless':179C 'unlimit':40B 'upload':35B,117C,165C,229C 'use':159C 'v3.1':89C 'valu':74C 'version':80C,84C 'via':3A 'whole':54B,141C 'within':58B,145C 'without':106C 'workaround':223C","nicknames":[],"mitigations":[],"who_affected":"Applications using the NestJS Fastify adapter with any upload interceptor from @nestjs/platform-fastify/multipart at default limits are exposed. The Express and Node adapters are not affected. No authentication is needed unless a guard protects the route.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["platformfastify"],"ptokens":["fastify","nestjs","platform"],"labels":["cwe400","cwe770","fastify","high","nestjs","node","npm","package","selfhosted"],"campaign_type":null,"search_a":"'3pxm':17A,22A 'adapt':12A 'c5rc':16A,21A 'crash':2A 'fastifi':11A 'field':5A 'ghsa':14A,19A 'ghsa-h94v-c5rc-3pxm':13A,18A 'h94v':15A,20A 'json':8A 'multipart':4A 'nestjs/platform-fastify':23A 'pars':6A 'process':1A 'via':3A","search_b":"'-400':25B '-770':27B 'accept':39B 'application/json':46B 'caus':69B 'cwe':24B,26B 'data':43B 'default':59B 'denial':70B 'exhaust':62B 'fastifi':28B 'field':42B 'heap':64B 'host':34B 'interceptor':36B 'keep':48B 'limit':60B 'multipart':41B 'nestj':29B 'nestjs/platform-fastify/multipart':38B 'node':30B 'object':51B 'packag':31B 'pars':50B 'process':68B 'request':55B,57B 'self':33B 'self-host':32B 'sent':44B 'servic':72B 'termin':66B 'unlimit':40B 'upload':35B 'whole':54B 'within':58B","search_c":"'-400':111C '-770':102C '1':206C '12.1.0':81C '12.5.0':82C,85C,196C '400':222C '7.5':99C 'accept':121C 'adapt':162C,189C 'affect':79C,174C,192C 'alloc':103C 'amount':123C 'anthrop':243C 'applic':158C 'application/json':130C 'authent':176C 'av':90C 'bodi':234C 'consumpt':114C 'could':149C 'credit':240C 'cvss':88C 'cwe':100C,101C,110C 'data':127C 'default':147C,171C,211C 'ecosystem':75C 'exhaust':150C 'express':186C 'fastifi':161C 'field':73C,126C,199C 'fix':194C 'guard':181C 'h':98C 'heap':152C 'high':87C 'impact':157C 'interceptor':118C,166C 'json':198C 'kept':138C 'l/pr':92C 'limit':107C,148C,172C,204C,218C,232C 'limits.fieldsize':227C 'limits.jsonfieldssize':212C 'limits.parts':225C 'lower':224C 'mib':207C 'multipart':125C 'n/a':97C 'n/ac':91C 'n/i':96C 'n/s':94C 'n/ui':93C 'need':178C 'nestjs/platform-fastify':78C 'nestjs/platform-fastify/multipart':120C,168C 'node':188C 'npm':76C 'object':135C 'oss':245C 'packag':77C 'pars':133C 'patch':83C,193C 'process':156C 'protect':182C 'proxi':239C 'reject':220C 'report':241C 'request':142C,144C,202C,215C,233C 'resourc':105C,113C 'revers':238C 'rout':184C,230C 'scanner':246C 'sent':128C 'sever':86C 'size':235C 'summari':115C 'termin':154C 'throttl':109C 'total':209C 'u/c':95C 'uncontrol':112C 'unless':179C 'upload':117C,165C,229C 'use':159C 'v3.1':89C 'valu':74C 'version':80C,84C 'whole':141C 'within':145C 'without':106C 'workaround':223C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:03:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-h94v-c5rc-3pxm","url":"https://github.com/nestjs/nest/security/advisories/GHSA-h94v-c5rc-3pxm","severity":"high","published_at":"2026-11-12T19:03:56+00:00","modified_at":"2026-11-12T19:03:56+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","fetched_at":"2026-11-12T19:14:24+00:00","note":null}],"documents":[{"id":137719,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-h94v-c5rc-3pxm","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}