CVE-2026-87908
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.
Risk Assessment
An attacker could remotely crash the server, causing service unavailability for legitimate users.
Recommendation
Upgrade the multiparty library to version 4.3.1 or later to limit header size and prevent memory exhaustion.
Other vulnerabilities in multiparty
See all- CVE-2026-8162High
Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to an uncaught exception. By sending a multipart/form-data request with a malformed percent-encoding in the Content-Disposition header, the parser invokes decodeURI without error handling, leading to a process crash.
- CVE-2026-8161High
Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to an uncaught exception. By sending a multipart/form-data request with a field name that collides with an Object.prototype property, the parser invokes .push() on the inherited prototype value, leading to a TypeError and crashing the process.
- CVE-2026-8159High
Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop.
Original NVD description (English source)
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS