Executive brief
The multiparty library, a popular tool for handling file uploads in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted file upload request that causes the server to become unresponsive by overwhelming its processing power. This can lead to service outages and prevent legitimate users from accessing the application.
Technical details
A Regular Expression Denial of Service (ReDoS) vulnerability exists in multiparty versions 4.2.3 and earlier due to inefficient regular expression complexity (CWE-1333) in the Content-Disposition filename parameter parser. An attacker can exploit this by sending a multipart upload request with a long, specifically crafted header value (e.g., repeating '!filename=\"1'). This triggers catastrophic backtracking in the regex engine, blocking the Node.js event loop for several seconds per request. The vulnerability can be triggered with a relatively small header (~8 KB), making it difficult to mitigate solely through upload size limits. The issue is resolved in version 4.3.0.
Affected products
- pillarjs multiparty <= 4.2.3
Timeline
- 2026-05-12: disclosed: Vulnerability disclosed and NVD entry published.
- 2026-05-18: advisory: GitHub Advisory published.
- 2026-05-12: patched: Version 4.3.0 released to address the issue.