CVE-2026-8161: multiparty denial of service via prototype pollution

Executive brief

The multiparty library, a popular tool for handling file uploads in Node.js applications, is vulnerable to a denial-of-service attack. By sending a specially crafted upload request, an attacker can cause the application to crash. This can lead to service outages and impact the availability of any web application that uses this library to process user uploads.

Technical details

The multiparty library (versions 4.2.3 and lower) is vulnerable to a denial-of-service (DoS) attack caused by an uncaught exception. The vulnerability occurs when a 'multipart/form-data' request contains a field name that matches an inherited property of 'Object.prototype' (such as '__proto__', 'constructor', or 'toString'). When the parser attempts to handle these fields, it incorrectly invokes the '.push()' method on the inherited prototype value instead of an array. This results in a 'TypeError' that propagates as an uncaught exception, crashing the Node.js process. The issue is fixed in version 4.3.0.

Affected products

• pillarjs multiparty <= 4.2.3

Timeline

• 2026-05-12: disclosed: Vulnerability published to NVD
• 2026-05-18: advisory: GitHub Advisory published

References

• https://api.github.com/users/Ser0n-ath
• https://github.com/Ser0n-ath
• https://api.github.com/users/Ser0n-ath/gists%7B/gist_id%7D
• https://api.github.com/users/Ser0n-ath/repos
• https://avatars.githubusercontent.com/u/40531057?v=4
• https://api.github.com/users/Ser0n-ath/events%7B/privacy%7D