{"metadata": {"vulnerability": "CVE-2026-19481", "count": 18, "kinds": {"milestone": 6, "sighting": 2, "kev": 0, "other": 10}, "linked_omitted": 2}, "data": [{"timestamp": "2026-08-10T15:38:12.624Z", "date_only": false, "value": "2026-08-10T15:38:12.624Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-19481", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-13T08:31:25.413Z", "date_only": false, "value": "2026-08-13T08:31:25.413Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19481", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-08-13T08:31:25.413Z", "date_only": false, "value": "2026-08-13T08:31:25.413Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / openjs", "record": "CVE-2026-19481", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-08-13T08:39:42.961Z", "date_only": false, "value": "2026-08-13T08:39:42.961130Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ulisesgascon.com/post/3msxamlgd722l", "record": "CVE-2026-19481", "field": "creation_timestamp", "uuid": "51eba80b-4eb9-4358-84d5-77b3bc99ee7f", "content": "\ud83d\udea8 High-severity security fix in @fastify/busboy@3.2.1 just released!\n\nPatches CVE-2026-19481: @fastify/busboy vulnerable to denial of service via prototype-named multipart part header\n\ngithub.com/fastify/busb...", "url": "https://bsky.app/profile/ulisesgascon.com/post/3msxamlgd722l"}, {"timestamp": "2026-08-13T09:17:12Z", "date_only": false, "value": "2026-08-13T09:17:12Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-X8MW-P69M-V3MX", "record": "GHSA-X8MW-P69M-V3MX", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-08-13T09:17:12.573Z", "date_only": false, "value": "2026-08-13T09:17:12.573", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19481", "record": "FKIE_CVE-2026-19481", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-08-13T14:25:06.775Z", "date_only": false, "value": "2026-08-13T14:25:06.775682Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19481", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-08-13T14:25:06.775Z", "date_only": false, "value": "2026-08-13T14:25:06.775682Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19481", "record": "FKIE_CVE-2026-19481", "field": "metrics.ssvcV203.0.ssvcData.timestamp", "linked_record": true}, {"timestamp": "2026-08-13T14:25:29.262Z", "date_only": false, "value": "2026-08-13T14:25:29.262Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-19481", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-08-13T14:25:29.262Z", "date_only": false, "value": "2026-08-13T14:25:29.262Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-19481", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-03T19:16:01.753Z", "date_only": false, "value": "2026-09-03T19:16:01.753", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-19481", "record": "FKIE_CVE-2026-19481", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-02T23:16:36Z", "date_only": false, "value": "2026-10-02T23:16:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-X8MW-P69M-V3MX", "record": "GHSA-X8MW-P69M-V3MX", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-02T23:16:36Z", "date_only": false, "value": "2026-10-02T23:16:36Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-X8MW-P69M-V3MX", "record": "GHSA-X8MW-P69M-V3MX", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-03T03:30:31Z", "date_only": false, "value": "2026-10-03T03:30:31.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/alon710/c80e910a67f87d0283ea5aa345d49e77", "record": "CVE-2026-19481", "field": "creation_timestamp", "uuid": "b93f9bd3-d047-4313-bbd0-7176c1a3e955", "content": "# CVE-2026-19481: CVE-2026-19481: Unauthenticated Remote Denial of Service via Prototype Lookup Crash in @fastify/busboy\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-10-02\n> **Full Report:** https://cvereports.com/reports/CVE-2026-19481\n\n## Summary\nA critical remote, unauthenticated Denial of Service (DoS) vulnerability in @fastify/busboy (<= 3.2.0) allows attackers to crash the Node.js process. By submitting a crafted multipart/form-data request with a header key matching an inherited property of Object.prototype (like __proto__ or constructor), the internal HeaderParser triggers a synchronous TypeError.\n\n## TL;DR\nUnauthenticated remote attackers can crash Node.js servers using @fastify/busboy by sending a multipart request with __proto__ or constructor in the headers, triggering an unhandled TypeError.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-754 (Variant of CWE-1321 Prototype Pollution via Prototype Lookup Crash)\n- **Attack Vector**: Network (AV:N)\n- **Attack Complexity**: Low (AC:L)\n- **Privileges Required**: None (PR:N)\n- **User Interaction**: None (UI:N)\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: Proof-of-Concept (PoC) in Test Suite\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Node.js applications running @fastify/busboy versions >= 1.0.0 and <= 3.2.0\n- Web frameworks utilizing affected versions of @fastify/busboy as a multipart parsing engine (e.g., Fastify, NestJS configurations)\n- **@fastify/busboy**: >= 1.0.0, <= 3.2.0 (Fixed in: `3.2.1`)\n\n## Mitigation\n\n- Upgrade @fastify/busboy to version >= 3.2.1\n- Configure WAF rules to drop multipart payloads containing __proto__ or constructor header fields\n- Implement robust process monitoring and automatic container restarts (e.g., systemd, pm2, Kubernetes) to recover from crashes\n\n**Remediation Steps:**\n1. Audit the application package-lock.json, yarn.lock, or pnpm-lock.yaml for transitive usage of @fastify/busboy.\n2. Execute 'npm update @fastify/busboy' or apply selective dependency resolutions to force version 3.2.1.\n3. Deploy edge validation rules to block raw multipart streams with prototype keys prior to reaching the application layer.\n4. Verify the fix by re-running the proof-of-concept curl script against a staging environment.\n\n## References\n\n- [https://nvd.nist.gov/vuln/detail/CVE-2026-19481](https://nvd.nist.gov/vuln/detail/CVE-2026-19481)\n- [https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx](https://github.com/fastify/busboy/security/advisories/GHSA-x8mw-p69m-v3mx)\n- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)\n- [https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b](https://github.com/fastify/busboy/commit/957a24b66d5915e6d0a6ac988c9dbcee86373e9b)\n- [https://github.com/fastify/busboy/releases/tag/v3.2.1](https://github.com/fastify/busboy/releases/tag/v3.2.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-19481) - Automated Vulnerability Intelligence*", "url": "https://gist.github.com/alon710/c80e910a67f87d0283ea5aa345d49e77"}, {"timestamp": "2026-10-21T00:00:00Z", "date_only": true, "value": "2026-10-21", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "vendor_advisories.0.published_at", "linked_record": true}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "last_revision_date", "linked_record": true}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-26T00:00:00Z", "date_only": false, "value": "2026-10-26T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1385", "record": "CERTFR-2026-AVI-1385", "field": "revisions.0.revision_date", "linked_record": true}], "metrics": {"as_of": "2026-11-15T10:17:01.427Z", "anchors": {"origin": {"timestamp": "2026-08-13T08:31:25.413Z", "date_only": false, "value": "2026-08-13T08:31:25.413Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19481", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-08-13T08:31:25.413Z", "date_only": false, "value": "2026-08-13T08:31:25.413Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19481", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 8127936.014281, "hours": 2257.7600039669446, "days": 94.07333349862269, "min_seconds": 8127936.014281, "max_seconds": 8127936.014281, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-08-13T08:31:25.413Z", "date_only": false, "value": "2026-08-13T08:31:25.413Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-19481", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-15T10:17:01.427Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}