Denial of Service Vulnerability in Multiparty by PillarJS

CVE-2026-8162

What is CVE-2026-8162?

Versions of the Multiparty package up to 4.2.3 are susceptible to denial of service vulnerabilities due to improperly handled multipart/form-data requests. Specifically, the failure to catch exceptions when processing malformed percent-encoded filename parameters results in uncaught exceptions that can crash the server process. Any application or service that accepts multipart uploads using the affected versions is at risk. Users are advised to upgrade to Multiparty version 4.3.0 or later to mitigate this risk, as there are no effective workarounds.

References