CVE-2026-66730 Details

A denial-of-service vulnerability has been identified in facil.io versions 0.6.0 through 0.7.6. The issue resides in the multipart body parser, where an unauthenticated remote attacker can permanently freeze worker processes by sending a multipart/form-data request with a partial closing boundary. This flaw causes the parser to return zero bytes consumed without indicating completion or an error, leading to an infinite loop that exhausts all worker processes. As a result, the server becomes unresponsive and requires a manual restart to recover.

The vulnerability can be addressed by adding a progress guard to the parser loop in the 'http_parse_body' function. This guard should check if the parser has made progress and, if not, set an error flag to break the loop, preventing the infinite cycle.