CVE-2026-66729: facil.io Integer Underflow Vulnerability Leading to Server Crash

CVE-2026-66729 describes an integer underflow vulnerability identified in facil.io versions up to and including 0.7.6. This flaw resides within the multipart MIME body parser, specifically in http_mime_parser.h. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP POST request. The attack involves manipulating the Content-Disposition header by providing an empty field name, which triggers a uint32_t wraparound. This leads to an out-of-bounds memory read beyond the expected name pointer, culminating in a bus fault that crashes the server's handling worker. The vulnerability requires only a single POST request to cause a Denial of Service, making affected facil.io deployments susceptible to easy disruption.

Attack Chain

1. An unauthenticated remote attacker identifies a server running facil.io through version 0.7.6.
2. The attacker crafts an HTTP POST request targeting the vulnerable server.
3. The crafted POST request includes a Content-Disposition header containing a multipart form-data structure.
4. Within this Content-Disposition header, the attacker sets a field name attribute (e.g., name or filename) to an empty string.
5. The facil.io application's multipart MIME body parser (implemented in http_mime_parser.h) attempts to process the malformed Content-Disposition header.
6. During parsing, the empty field name triggers an integer underflow, causing a uint32_t variable to wrap around.
7. This wraparound condition leads to an out-of-bounds memory read past the name pointer.
8. The out-of-bounds memory access results in a bus fault, causing the facil.io handling worker process to crash and the server to experience a Denial of Service.

Impact

Successful exploitation of CVE-2026-66729 leads directly to a Denial of Service (DoS) condition on affected servers. Attackers can remotely crash the server process with a single HTTP POST request, making the server unresponsive and unavailable to legitimate users. While specific victim numbers or targeted sectors are not detailed, any organization utilizing facil.io through version 0.7.6 in an internet-facing capacity is vulnerable to service disruption. This could impact critical web services, APIs, or other applications built upon the facil.io framework.

Recommendation

• Patch CVE-2026-66729 immediately by upgrading facil.io to a version beyond 0.7.6 or applying the provided security fix.
• Monitor web server logs for POST requests containing unusual or malformed Content-Disposition headers, particularly those with empty name or filename attributes, as indicated by the vulnerability description for CVE-2026-66729.
• Review the references from the NVD entry to understand the full technical details of CVE-2026-66729 and any potential workarounds.