@fastify/busboy is a Node.js module for parsing incoming HTML form data as a streaming parser. It is useful for handling multipart form uploads (files and fields) and processing each file and field via emitted events as the request body is piped in.
Project status
- Actively maintained, with an upstream push and update on 2026-10-22.
- Updates were sparse between August 2025 and August 2026, then several arrived from August through October 2026.
AI summary generated
Recent updates
v3.2.5
Version 3.2.5 fixes URL-encoded parsing so incomplete percent-encoded bytes are preserved literally when a key or value ends at a field boundary or at the end of the input. It also updates the pinned reusable release workflow; no public API breaking changes are apparent in the diff.
v3.2.4
v3.2.4 fixes header parsing when the CRLFCRLF terminator is split across input chunks, preventing terminator bytes from appearing in the final header value. It also removes the package.json `files` allowlist, which changes the package's publication configuration.
v3.2.3
v3.2.3 focuses on a bug fix for multipart parsing where an RFC 2046 epilogue arriving after the closing boundary could cause the parser to hang. The release notes also mention CI changes to enable trusted publishing via OIDC.
v3.2.2
This release is a security patch for GHSA-gxm5-99cw-xjw9. The code changes harden multipart and header parsing by rejecting inputs that contain bare CR or LF characters in header names and values, rather than returning or exposing those characters.
BreakingSecurityv3.2.1
v3.2.1 is a security-only release of @fastify/busboy intended to address two GHSA advisories (upgrade to v3.2.1). The release notes do not describe the specific code changes beyond the advisory links.
Securityv3.2.0
v3.2.0 updates development and CI tooling, including switching Dependabot to monthly npm updates, renaming CI references from master to main, and aligning to Node.js builtin import specifiers via the node: prefix. Functionally, it adds stricter parsing behavior for quoted parameters (RFC 2183/7578 compliance), and updates several dev dependencies (TypeScript, @types/node, tinybench, tsd).
v3.1.1
v3.1.1 is a small maintenance release with a documentation tweak to the CI badge URL and a change inside the bundled stream search implementation. The code change focuses on how the last character of the needle is checked during streaming, and it adds a targeted test case for an overflowing needle scenario.
v3.1.0
v3.1.0 focuses on developer tooling and performance tweaks. The release notes document a migration from tap to node:test (with c8 for coverage) and several changes to the streamsearch boundary matching implementation for performance, alongside dependency bumps and CI workflow cleanup.
v3.0.0
v3.0.0 release notes primarily describe a performance refactor in the internal StreamSearch implementation, plus some test additions and CI/development dependency updates. The code diff confirms the StreamSearch changes and shows additional operational and runtime-impacting tweaks that are not mentioned in the release notes.
Breakingv2.1.1
v2.1.1 is a small maintenance release with documentation updates, a dev dependency bump (tsd), and a new test for decodeText. The only runtime behavior change is an internal implementation detail: event gating in the multipart/dicer pipeline now uses EventEmitter listenerCount instead of relying on undocumented internal _events.
v2.1.0
v2.1.0 primarily performs internal performance work around multipart/query parameter decoding, and migrates the test suite from mocha/chai to tap. It also includes CI dependency bumps (GitHub Actions) and adds missing use strict directives across benchmarks and tests.
v2.0.0
v2.0.0 includes several functional changes to Busboy behavior around initialization and multipart boundary handling, plus a change that removes text-decoding. It also updates development tooling dependencies (TypeScript, Node types, tsd, ESLint plugin) and includes a small performance-related change for builtin imports.
Breaking2.0.0
Release 2.0.0 focuses on multipart parsing behavior changes, including fixing a constructor/callability issue, removing the text-decoding dependency, and adding an error for missing multipart boundaries. It also bumps TypeScript, @types/node, and tsd, and updates CI and lint/test tooling.
Breakingv1.2.1
Release v1.2.1 makes a behavioral change centered on busboy shutdown handling, specifically reverting prior logic that destroyed the active file stream when the busboy instance was unpiped, canceled, or destroyed. It also updates .gitignore to ignore the .clinic file and bumps the package version to 1.2.1.
Breakingv1.2.0
v1.2.0 updates the project to require Node 14+, and improves busboy cleanup behavior by destroying in-progress file streams when the busboy instance is unpiped, cancelled, or destroyed. The diff also shows a substantial internal refactor of the utilities module layout (moving code out of lib/utils.js into separate files) along with dev and CI/tooling updates.
Breaking