CVE-2025-24033

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

@fastify/multipart is a Fastify plugin for parsing the multipart content-type. Prior to versions 8.3.1 and 9.0.3, the `saveRequestFiles` function does not delete the uploaded temporary files when user cancels the request. The issue is fixed in versions 8.3.1 and 9.0.3. As a workaround, do not use `saveRequestFiles`.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-240343.2Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Starting in version 0.7.0 and prior to versions 0.7.15 and CVE-2025-240358.1Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a CVE-2025-240367.0Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability CVE-2025-240397.3Visual Studio Code Elevation of Privilege Vulnerability CVE-2025-24044.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies S CVE-2025-240427.3Visual Studio Code JS Debug Extension Elevation of Privilege Vulnerability CVE-2025-240437.5Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network.CVE-2025-240447.8Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.CVE-2025-240458.1Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a CVE-2025-240467.8Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally.CVE-2025-240487.8Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally.CVE-2025-240498.4Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauth