CVE-2026-8159: multiparty vulnerable to ReDoS via filename parsing
Impact
multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A multipart upload with a long header value containing !filename="1 repeated can cause regex matching to take seconds, blocking the event loop. Any service accepting multipart uploads via multiparty is affected.
Patches
Users should upgrade to multiparty@4.3.0 or higher.
Workarounds
None. Limiting upload sizes at the proxy/gateway layer reduces but does not eliminate the attack surface, since a small ~8 KB header is sufficient to trigger the vulnerable backtracking.
Resources
- OWASP: Regular expression Denial of Service (ReDoS)
Other sources
multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: limiting upload sizes at the proxy or gateway layer reduces but does not eliminate the attack surface, since a small header of around 8 KB is sufficient to trigger the vulnerable backtracking. Upgrade to multiparty@4.3.0 or higher.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multipartyto a version that resolves this vulnerability.Fixed in 4.3.0 - Upgrade
Upgrade
multipartyto a version that resolves this vulnerability.Fixed in 4.3.0 - Compensating control
Limit upload sizes at the proxy/gateway layer to reduce the attack surface (does not eliminate it), since a small header of around 8 KB can trigger the vulnerable regex backtracking.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8159?
CVE-2026-8159 is classified as a denial of service vulnerability due to regular expression backtracking issues.
How do I fix CVE-2026-8159?
To fix CVE-2026-8159, upgrade to multiparty version 4.2.4 or later.
What versions of multiparty are affected by CVE-2026-8159?
Multiparty versions up to and including 4.2.3 are affected by CVE-2026-8159.
What is the impact of CVE-2026-8159 on applications?
The impact of CVE-2026-8159 can lead to denial of service, causing applications to become unresponsive due to regex processing delays.
Is there a known exploit for CVE-2026-8159?
As of now, there is no public information regarding active exploits for CVE-2026-8159.