@fastify/busboy is a Node.js module for parsing incoming HTML form data as a streaming parser. It is useful for handling multipart form uploads (files and fields) and processing each file and field via emitted events as the request body is piped in.
Project status
- Actively maintained, with security-focused updates recently (v3.2.2 on 2026-08-21, v3.2.1 on 2026-08-12), and multiple prior updates in the past 2 years.
- Apparent cadence is roughly every 1 to 2 weeks for the latest security fixes (Aug 12 to Aug 21, 2026), versus much longer gaps earlier in the project history (for example, v3.2.0 in 2025-08).
AI summary generated
Recent updates
v3.2.2
This release is a security patch for GHSA-gxm5-99cw-xjw9. The code changes harden multipart and header parsing by rejecting inputs that contain bare CR or LF characters in header names and values, rather than returning or exposing those characters.
BreakingSecurityv3.2.1
v3.2.1 is a security-only release of @fastify/busboy intended to address two GHSA advisories (upgrade to v3.2.1). The release notes do not describe the specific code changes beyond the advisory links.
Securityv3.2.0
v3.2.0 updates development and CI tooling, including switching Dependabot to monthly npm updates, renaming CI references from master to main, and aligning to Node.js builtin import specifiers via the node: prefix. Functionally, it adds stricter parsing behavior for quoted parameters (RFC 2183/7578 compliance), and updates several dev dependencies (TypeScript, @types/node, tinybench, tsd).
v3.1.1
v3.1.1 is a small maintenance release with a documentation tweak to the CI badge URL and a change inside the bundled stream search implementation. The code change focuses on how the last character of the needle is checked during streaming, and it adds a targeted test case for an overflowing needle scenario.
v3.1.0
v3.1.0 focuses on developer tooling and performance tweaks. The release notes document a migration from tap to node:test (with c8 for coverage) and several changes to the streamsearch boundary matching implementation for performance, alongside dependency bumps and CI workflow cleanup.
v3.0.0
v3.0.0 release notes primarily describe a performance refactor in the internal StreamSearch implementation, plus some test additions and CI/development dependency updates. The code diff confirms the StreamSearch changes and shows additional operational and runtime-impacting tweaks that are not mentioned in the release notes.
Breakingv2.1.1
v2.1.1 is a small maintenance release with documentation updates, a dev dependency bump (tsd), and a new test for decodeText. The only runtime behavior change is an internal implementation detail: event gating in the multipart/dicer pipeline now uses EventEmitter listenerCount instead of relying on undocumented internal _events.
v2.1.0
v2.1.0 primarily performs internal performance work around multipart/query parameter decoding, and migrates the test suite from mocha/chai to tap. It also includes CI dependency bumps (GitHub Actions) and adds missing use strict directives across benchmarks and tests.
v2.0.0
v2.0.0 includes several functional changes to Busboy behavior around initialization and multipart boundary handling, plus a change that removes text-decoding. It also updates development tooling dependencies (TypeScript, Node types, tsd, ESLint plugin) and includes a small performance-related change for builtin imports.
Breaking2.0.0
Release 2.0.0 focuses on multipart parsing behavior changes, including fixing a constructor/callability issue, removing the text-decoding dependency, and adding an error for missing multipart boundaries. It also bumps TypeScript, @types/node, and tsd, and updates CI and lint/test tooling.
Breakingv1.2.1
Release v1.2.1 makes a behavioral change centered on busboy shutdown handling, specifically reverting prior logic that destroyed the active file stream when the busboy instance was unpiped, canceled, or destroyed. It also updates .gitignore to ignore the .clinic file and bumps the package version to 1.2.1.
Breakingv1.2.0
v1.2.0 updates the project to require Node 14+, and improves busboy cleanup behavior by destroying in-progress file streams when the busboy instance is unpiped, cancelled, or destroyed. The diff also shows a substantial internal refactor of the utilities module layout (moving code out of lib/utils.js into separate files) along with dev and CI/tooling updates.
Breaking