npm multiparty vulnerabilities

Latest npm multiparty CVEs

Newest publication first

1. CVE-2026-87908 multiparty vulnerable to Denial of Service via unbounded part-header accumulation

   Published 2026-09-11

   High·CVSS 7.5 EPSS 0.51%

   multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can sen...

2. CVE-2026-8162 multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing

   Published 2026-05-12

   High·CVSS 7.5 EPSS 0.33%

   multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser invokes decodeURI on the value wi...

3. CVE-2026-8161 multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception

   Published 2026-05-12

   High·CVSS 7.5 EPSS 0.47%

   multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as proto, constructor, or toString, the parser invokes .push()...

4. CVE-2026-8159 multiparty vulnerable to ReDoS via filename parsing

   Published 2026-05-12

   High·CVSS 7.5 EPSS 0.34%

   multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.