CVE-2026-19474

COMPONENT VERSION RANGE

NewScan fingerprints @fastify/multipart from its response and reports this CVE when the detected version falls inside the affected range below.

Added 2026-08-16. ONE row for both ids because one release fixes both and the remediation sentence is identical - the Bouncy Castle precedent. They are genuinely two bugs with two ranges: CVE-2026-19474 (3.0.0-10.1.0) is saveRequestFiles() rejecting while the async iterator keeps going, so already-completed temp files skip per-file cleanup and os.tmpdir() grows linearly with aborted uploads; CVE-2026-18549 (5.3.0-10.1.0) is the narrower and nastier one - a part over the fileSize limit plus a client that never sends the closing boundary leaves saveRequestFiles() unsettled forever, so the handler hangs AND the temp file stays. The row's `cve` is the WIDER id on purpose: a 4.x install matches this row and is told CVE-2026-19474, which is true of it, and `cves` carries the SIBLING id alone so CVE-2026-18549 also gets a /cve page (the gate rejects a `cves` entry that repeats the row's own `cve`). Both are unauthenticated and cheap to repeat, which is what makes a 7.5 availability bug worth a row. Version source: the npm manifests in version_tools._MANIFESTS. INERT ON EXISTING INSTALLS until the release carrying the scoped-name lookup - see the @fastify/jwt note.