Denial of Service Vulnerability in multiparty Node.js Library by Pillar

CVE-2026-87908

What is CVE-2026-87908?

The multiparty library for Node.js, used for parsing multipart/form-data request bodies, is susceptible to a denial of service attack due to improper handling of large header inputs. Versions from 2.1.0 up to but not including 4.3.1 lack constraints on memory allocation while accumulating headers for multipart parts. This allows unauthenticated attackers to exploit the parser by sending a crafted request, which can overwhelm server memory and lead to server crashes. To mitigate this risk, users are advised to upgrade to multiparty version 4.3.1 or later, where header size limitations have been implemented.

References