CVE-2026-8159: Pillarjs multiparty ReDoS in Content-Disposition filename parser

CVE-2026-8159 · Severity: high · CVSS 7.5 · Published 2026-05-12

The multiparty library, a popular tool for handling file uploads in Node.js applications, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted file upload request that causes the server to become unresponsive by overwhelming its processing power. This can lead to service outages and prevent legitimate users from accessing the application.

Technologies: multiparty (npm), Pillarjs Multiparty. Vendors: npm, Pillarjs.

Quick answers

Is CVE-2026-8159 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8159 being exploited in the wild.
How severe is CVE-2026-8159?
High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?
multiparty (npm) SEMVER:introduced=0,fixed=4.3.0; Pillarjs Multiparty <= 4.2.3.
Is there a fix for CVE-2026-8159?
Yes. multiparty (npm): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8159 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8159?
Check whether you run multiparty (npm) or Pillarjs Multiparty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • multiparty (npm): upgrade to 4.3.0 or later
    npm install multiparty@4.3.0

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in multiparty versions 4.2.3 and earlier due to inefficient regular expression complexity (CWE-1333) in the Content-Disposition filename parameter parser. An attacker can exploit this by sending a multipart upload request with a long, specifically crafted header value (e.g., repeating '!filename=\"1'). This triggers catastrophic backtracking in the regex engine, blocking the Node.js event loop for several seconds per request. The vulnerability can be triggered with a relatively small header (~8 KB), making it difficult to mitigate solely through upload size limits. The issue is resolved in version 4.3.0.

Affected products

  • pillarjs multiparty <= 4.2.3

Identifiers

  • CVE-2026-8159
  • GHSA-65x3-rw7q-gx94

Timeline

  • 2026-05-12: disclosed: Vulnerability disclosed and NVD entry published.
  • 2026-05-18: advisory: GitHub Advisory published.
  • 2026-05-12: patched: Version 4.3.0 released to address the issue.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.