Denial of Service in multiparty Product by PillarJS

CVE-2026-8159

What is CVE-2026-8159?

The multiparty package, used for handling multipart uploads, is susceptible to exploitation through a denial of service attack. This vulnerability arises when a crafted multipart upload with an excessively long header value triggers excessive regular expression backtracking in the Content-Disposition filename parameter parser, causing the event loop to block for extended periods. As a result, any service accepting multipart uploads via this library can experience service degradation. It is recommended to upgrade to multiparty version 4.3.0 or later to mitigate this vulnerability. Limiting upload sizes at the proxy or gateway can offer some protection, though even small header values may still lead to blocking.

References