[anupamme]

This upgrades @fastify/busboy (currently 2.1.1) to 3.2.1, which carries the fix for CVE-2026-19481. The package is present in this repository's dependency tree; I have not verified that your code reaches the affected function.

Reference: CVE-2026-19481

What changed

• package.json
• package-lock.json

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[rya-sge]

Hello @anupamme

Thanks a lot for the PR.

We will however won't merge this PR for the following reason:

@fastify/busboy is only pulled in by the development tooling (hardhat → undici@5). It isn't part of the deployed contracts, and we found no call to formData() in Hardhat's internal code or in hardhat-verify, which is the path that would reach it.

The override also forces busboy 3.x under undici@5, which declares ^2.0.0. That's an unsupported combination, and it wasn't tested here, so we'd rather not add it for code that doesn't seem to run.

We're handling it another way: hardhat moves to devDependencies, so installing CMTAT as a package no longer pulls in hardhat or busboy (npm audit --omit=dev reports 0 vulnerabilities).

In the future, the development dependency will go away with the Hardhat 3 migration.

Best,

[anupamme]

Thanks for the detailed investigation. I agree that forcing busboy 3.x under undici 5.x is not an appropriate fix given the compatibility constraints.

Would you be open to repurposing this PR to move Hardhat from dependencies to devDependencies instead?

This would eliminate the vulnerable transitive dependency from production installations without introducing an incompatible override.

I can update the PR, regenerate the package-lock.json, and validate the change with npm audit --omit=dev, along with the existing build and test suite.

If you’re already working on this change, I’m happy to coordinate to avoid duplicating your work.

[rya-sge]

Would you be open to repurposing this PR to move Hardhat from dependencies to devDependencies instead?

Already done, thanks a lot: package.json#L75