@NESTJS/PLATFORM-FASTIFY · GHSA-hpvc-wj3g-h9p8 · Package
FIX → 12.1.3
A single small multipart request with a large array index in a field name makes @nestjs/platform-fastify spend time proportional to that index, blocking the Node.js event loop. Some field names also make the request fail with a 500 error.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the Fastify adapter together with any upload interceptor from @nestjs/platform-fastify/multipart are exposed. The advisory states no authentication is needed unless a guard protects the route. Apps that do not use the Fastify adapter or multipart uploads can skip it.
Not affected if express-adapter, no-multipart-uploads
Who cares fastify, nestjs, node, self-hosted
npm ls @nestjs/platform-fastify to see the installed version.@nestjs/platform-fastify/multipart.Upgrade to 12.1.3
| Field | Value |
|---|---|
| Ecosystem | npm |
| Package | @nestjs/platform-fastify |
| Affected versions | >= 12.1.0, < 12.1.3 |
| Patched versions | 12.1.3 |
| Severity | High |
| CVSS v3.1 | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5) |
| CWE | CWE-834 (Excessive Iteration), CWE-400 (Uncontrolled Resource Consumption) |
The multipart parser of @nestjs/platform-fastify could take time proportional to the largest array index in a field name, not to the number of fields sent. A single small request could block the event loop for a long time, and some field names made the request fail with a 500.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
Applications using the Fastify adapter with any upload interceptor from @nestjs/platform-fastify/multipart are affected. No authentication is needed unless a guard protects the route.
Fixed in 12.1.3. Field objects are built from the items present only, and invalid field names are answered with 400. Since 12.2.0, fieldArrayIndexLimit also defaults to 1000.
Upgrade. There is no configuration workaround on the affected versions.
Found by the NestJS maintainers.