multiparty vulnerabilities

Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to an uncaught exception. By sending a multipart/form-data request with a malformed percent-encoding in the Content-Disposition header, the parser invokes decodeURI without error handling, leading to a process crash.

Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to an uncaught exception. By sending a multipart/form-data request with a field name that collides with an Object.prototype property, the parser invokes .push() on the inherited prototype value, leading to a TypeError and crashing the process.

Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop.