@fastify/busboy vulnerable to CRLF injection via multipart Content-Disposition filename and name

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-74866 · Microsoft / collected KEV context

EUVD-2026-63829

GHSA-gxm5-99cw-xjw9

cve-program · CVE-2026-74866

• https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9
• https://cna.openjsf.org/security-advisories.html

euvd · EUVD-2026-63829

• https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9
• https://cna.openjsf.org/security-advisories.html

nvd · CVE-2026-74866

• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9

osv · GHSA-gxm5-99cw-xjw9

• https://github.com/fastify/busboy/security/advisories/GHSA-gxm5-99cw-xjw9
• https://nvd.nist.gov/vuln/detail/CVE-2026-74866
• https://github.com/fastify/busboy/commit/cc7da17c5c88d79c314a9e149a79e5a00a6c23be
• https://cna.openjsf.org/security-advisories.html
• https://github.com/fastify/busboy
• https://github.com/fastify/busboy/releases/tag/v3.2.2

No related operational record is retained in the current change model.