[Security] Silent data loss for RFC 5987 extended parameters with non-standard charsets

[y0un9eee]

Security Vulnerability Report

Hi @mscdex,

I've discovered a security-relevant bug in busboy v1.6.0. I'm using a public issue since your repository does not have private vulnerability reporting enabled.

I'm intentionally omitting full PoC details to avoid public disclosure before a fix is available. Please enable private vulnerability reporting or contact me via GitHub so I can share the full report privately.

Summary (without exploit details)

In lib/utils.js, the decoders.other decoder is declared as an arrow function, which makes decoders.other.bind(charset) in getDecoder() ineffective — arrow functions cannot have this rebound via bind().

As a result, multipart form fields and files submitted with non-standard charsets in RFC 5987 extended parameters (e.g. filename*=shift_jis''..., name*=euc-kr''...) are silently dropped from parsed output with no error or warning.

Affected

• Package: busboy v1.6.0 (latest)
• File: lib/utils.js — decoders.other (line 461), getDecoder() (line 416)
• Affected charsets: Any charset not in the hardcoded list (utf-8, latin1, utf-16le, base64) — e.g. shift_jis, gb2312, euc-kr, big5

Impact

• Data integrity: Fields silently dropped, not emitted to application
• Potential validation bypass: Required fields may be silently omitted

Fix (high-level)

Change decoders.other from an arrow function to a regular function expression so that bind() works as intended.

---

Reporter: @y0un9eee
Reported: 2026-05-28
Disclosure deadline: 2026-08-26 (90 days)

Please acknowledge receipt. I can share the full technical report with PoC privately.

[mscdex]

Duplicate of #348