CVE-2026-8162: multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
Impact
multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition: filename=utf-8'' header containing a malformed percent-encoding (e.g., %FF, %GG), the parser invokes decodeURI on the value without try/catch. The resulting URIError propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected.
Patches
Users should upgrade to multiparty@4.3.0 or higher.
Workarounds
None.
Other sources
multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename parameter contains a malformed percent-encoding, the parser invokes decodeURI on the value without try/catch. The resulting URIError propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to multiparty@4.3.0 or higher.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multipartyto a version that resolves this vulnerability.Fixed in 4.3.0 - Upgrade
Upgrade
multipartyto a version that resolves this vulnerability.Fixed in 4.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8162?
CVE-2026-8162 is classified as a Denial of Service vulnerability.
How do I fix CVE-2026-8162?
To fix CVE-2026-8162, update the multiparty package to version 4.2.4 or higher.
Which versions of multiparty are affected by CVE-2026-8162?
Multiparty versions 4.2.3 and lower are affected by CVE-2026-8162.
What type of attack is associated with CVE-2026-8162?
CVE-2026-8162 is associated with a Denial of Service attack via uncaught exceptions.
What component is vulnerable in CVE-2026-8162?
The filename* parameter parsing in multiparty is the vulnerable component in CVE-2026-8162.