CVE-2025-24033: Fastify Fastify-Multipart

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.

Affected products

• Fastify Fastify-Multipart: before 8.3.1 (fixed in 8.3.1); from 9.0.0, before 9.0.3 (fixed in 9.0.3)

Published 2025-01-23. Last modified 2026-06-17.