CVE-2026-8162
HIGH7.5EPSS 0.06%multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
Published: 5/18/2026Modified: 5/18/2026
Also known as:GHSA-xh3c-6gcq-g4rv
Description
### Impact [email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a `Content-Disposition: filename*=utf-8''` header containing a malformed percent-encoding (e.g., `%FF`, `%GG`), the parser invokes `decodeURI` on the value without try/catch. The resulting `URIError` propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected. ### Patches Users should upgrade to [email protected] or higher. ### Workarounds None.
Affected packages (2)
- Debian/node-multipartyfrom 0
- npm/multipartyfrom 0, < 4.3.0
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References (6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-8162
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-8162
- PATCHhttps://github.com/pillarjs/multiparty
- WEBhttps://cna.openjsf.org/security-advisories.html
- WEBhttps://github.com/pillarjs/multiparty/releases/tag/v4.3.0
- WEBhttps://github.com/pillarjs/multiparty/security/advisories/GHSA-xh3c-6gcq-g4rv