{"id":"GHSA-hpvc-wj3g-h9p8","kind":"vulnerability","aliases":["GHSA-hpvc-wj3g-h9p8"],"related":[],"title":"Blocked event loop via sparse array field names on the Fastify adapter","description":"| Field | Value |\n| --- | --- |\n| Ecosystem | npm |\n| Package | `@nestjs/platform-fastify` |\n| Affected versions | `>= 12.1.0, < 12.1.3` |\n| Patched versions | `12.1.3` |\n| Severity | High |\n| CVSS v3.1 | `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H` (7.5) |\n| CWE | CWE-834 (Excessive Iteration), CWE-400 (Uncontrolled Resource Consumption) |\n\n### Summary\n\nThe multipart parser of `@nestjs/platform-fastify` could take time proportional to the largest array index in a field name, not to the number of fields sent. A single small request could block the event loop for a long time, and some field names made the request fail with a 500.\n\n### Impact\n\nApplications using the Fastify adapter with any upload interceptor from `@nestjs/platform-fastify/multipart` are affected. No authentication is needed unless a guard protects the route.\n\n### Patches\n\nFixed in **12.1.3**. Field objects are built from the items present only, and invalid field names are answered with 400. Since 12.2.0, `fieldArrayIndexLimit` also defaults to 1000.\n\n### Workarounds\n\nUpgrade. There is no configuration workaround on the affected versions.\n\n### Credit\n\nFound by the NestJS maintainers.","summary":"A single small multipart request with a large array index in a field name makes @nestjs/platform-fastify spend time proportional to that index, blocking the Node.js event loop. Some field names also make the request fail with a 500 error.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@nestjs/platform-fastify","fixed":["12.1.3"],"affected":">= 12.1.0, < 12.1.3","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-400","cwe-834","fastify","nestjs","node","package","self-hosted"],"not_affected_if":["express-adapter","no-multipart-uploads"],"how_to_check":"- Run `npm ls @nestjs/platform-fastify` to see the installed version.\n- Check whether any route uses an upload interceptor from `@nestjs/platform-fastify/multipart`.","fix":null,"status":"open","published_at":"2026-11-12T19:03:58+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","triaged_at":"2026-11-12T19:15:44+00:00","updated_at":"2026-11-12T19:15:44+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-12T19:15:44Z","model":"claude-haiku-5-5","output":{"fix":"- `@nestjs/platform-fastify` `12.1.3` (fixed version; affected range is `>= 12.1.0, < 12.1.3`).\n- Since `12.2.0`, `fieldArrayIndexLimit` defaults to `1000`.","reach":"internet","title":"NestJS Fastify adapter: sparse multipart field names block the event loop","impact":"low","summary":"A single small multipart request with a large array index in a field name makes @nestjs/platform-fastify spend time proportional to that index, blocking the Node.js event loop. Some field names also make the request fail with a 500 error.","audience":"developers","category":"package","nicknames":[],"who_cares":["nestjs","node","fastify","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Single small request stalls the Node.js event loop for a long time","analyst_note":"","how_to_check":"- Run `npm ls @nestjs/platform-fastify` to see the installed version.\n- Check whether any route uses an upload interceptor from `@nestjs/platform-fastify/multipart`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["express-adapter","no-multipart-uploads"],"who_is_affected":"Applications that use the Fastify adapter together with any upload interceptor from @nestjs/platform-fastify/multipart are exposed. The advisory states no authentication is needed unless a guard protects the route. Apps that do not use the Fastify adapter or multipart uploads can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000786,"input_tokens":5005,"output_tokens":570,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-400':25B,107C '-834':27B,103C '1000':212C '12.1.0':82C '12.1.3':83C,86C,188C '12.2.0':207C '400':205C '500':72B,160C '7.5':100C 'adapt':12A,166C 'affect':80C,174C,222C 'also':65B,209C 'answer':203C 'applic':162C 'array':6A,43B,124C 'authent':176C 'av':91C 'block':1A,57B,142C 'built':192C 'configur':218C 'consumpt':110C 'could':117C,141C 'credit':224C 'cvss':89C 'cwe':24B,26B,101C,102C,106C 'default':210C 'ecosystem':76C 'error':73B 'event':2A,60B,144C 'excess':104C 'fail':69B,157C 'fastifi':11A,28B,165C 'field':7A,47B,63B,74C,128C,135C,152C,189C,200C 'fieldarrayindexlimit':208C 'fix':186C 'found':225C 'ghsa':14A,19A 'ghsa-hpvc-wj3g-h9p8':13A,18A 'guard':181C 'h':99C 'h9p8':17A,22A 'high':88C 'host':34B 'hpvc':15A,20A 'impact':161C 'index':44B,56B,125C 'interceptor':170C 'invalid':199C 'item':195C 'iter':105C 'l/pr':93C 'larg':42B 'largest':123C 'long':148C 'loop':3A,61B,145C 'made':154C 'maintain':229C 'make':49B,66B 'multipart':38B,113C 'n/a':98C 'n/ac':92C 'n/i':97C 'n/s':95C 'n/ui':94C 'name':8A,48B,64B,129C,153C,201C 'need':178C 'nestj':29B,228C 'nestjs/platform-fastify':23A,50B,79C,116C 'nestjs/platform-fastify/multipart':172C 'node':30B 'node.js':59B 'npm':77C 'number':133C 'object':190C 'packag':31B,78C 'parser':114C 'patch':84C,185C 'present':196C 'proport':53B,120C 'protect':182C 'request':39B,68B,140C,156C 'resourc':109C 'rout':184C 'self':33B 'self-host':32B 'sent':136C 'sever':87C 'sinc':206C 'singl':36B,138C 'small':37B,139C 'spars':5A 'spend':51B 'summari':111C 'take':118C 'time':52B,119C,149C 'u/c':96C 'uncontrol':108C 'unless':179C 'upgrad':214C 'upload':169C 'use':163C 'v3.1':90C 'valu':75C 'version':81C,85C,223C 'via':4A 'wj3g':16A,21A 'workaround':213C,219C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Fastify adapter together with any upload interceptor from @nestjs/platform-fastify/multipart are exposed. The advisory states no authentication is needed unless a guard protects the route. Apps that do not use the Fastify adapter or multipart uploads can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["platformfastify"],"ptokens":["fastify","nestjs","platform"],"labels":["cwe400","cwe834","fastify","high","nestjs","node","npm","package","selfhosted"],"campaign_type":null,"search_a":"'adapt':12A 'array':6A 'block':1A 'event':2A 'fastifi':11A 'field':7A 'ghsa':14A,19A 'ghsa-hpvc-wj3g-h9p8':13A,18A 'h9p8':17A,22A 'hpvc':15A,20A 'loop':3A 'name':8A 'nestjs/platform-fastify':23A 'spars':5A 'via':4A 'wj3g':16A,21A","search_b":"'-400':25B '-834':27B '500':72B 'also':65B 'array':43B 'block':57B 'cwe':24B,26B 'error':73B 'event':60B 'fail':69B 'fastifi':28B 'field':47B,63B 'host':34B 'index':44B,56B 'larg':42B 'loop':61B 'make':49B,66B 'multipart':38B 'name':48B,64B 'nestj':29B 'nestjs/platform-fastify':50B 'node':30B 'node.js':59B 'packag':31B 'proport':53B 'request':39B,68B 'self':33B 'self-host':32B 'singl':36B 'small':37B 'spend':51B 'time':52B","search_c":"'-400':107C '-834':103C '1000':212C '12.1.0':82C '12.1.3':83C,86C,188C '12.2.0':207C '400':205C '500':160C '7.5':100C 'adapt':166C 'affect':80C,174C,222C 'also':209C 'answer':203C 'applic':162C 'array':124C 'authent':176C 'av':91C 'block':142C 'built':192C 'configur':218C 'consumpt':110C 'could':117C,141C 'credit':224C 'cvss':89C 'cwe':101C,102C,106C 'default':210C 'ecosystem':76C 'event':144C 'excess':104C 'fail':157C 'fastifi':165C 'field':74C,128C,135C,152C,189C,200C 'fieldarrayindexlimit':208C 'fix':186C 'found':225C 'guard':181C 'h':99C 'high':88C 'impact':161C 'index':125C 'interceptor':170C 'invalid':199C 'item':195C 'iter':105C 'l/pr':93C 'largest':123C 'long':148C 'loop':145C 'made':154C 'maintain':229C 'multipart':113C 'n/a':98C 'n/ac':92C 'n/i':97C 'n/s':95C 'n/ui':94C 'name':129C,153C,201C 'need':178C 'nestj':228C 'nestjs/platform-fastify':79C,116C 'nestjs/platform-fastify/multipart':172C 'npm':77C 'number':133C 'object':190C 'packag':78C 'parser':114C 'patch':84C,185C 'present':196C 'proport':120C 'protect':182C 'request':140C,156C 'resourc':109C 'rout':184C 'sent':136C 'sever':87C 'sinc':206C 'singl':138C 'small':139C 'summari':111C 'take':118C 'time':119C,149C 'u/c':96C 'uncontrol':108C 'unless':179C 'upgrad':214C 'upload':169C 'use':163C 'v3.1':90C 'valu':75C 'version':81C,85C,223C 'workaround':213C,219C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T19:03:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-hpvc-wj3g-h9p8","url":"https://github.com/nestjs/nest/security/advisories/GHSA-hpvc-wj3g-h9p8","severity":"high","published_at":"2026-11-12T19:03:58+00:00","modified_at":"2026-11-12T19:03:58+00:00","first_seen_at":"2026-11-12T19:14:24+00:00","fetched_at":"2026-11-12T19:44:18+00:00","note":null}],"documents":[{"id":137718,"url":"https://github.com/nestjs/nest/security/advisories/GHSA-hpvc-wj3g-h9p8","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}