Executive brief
A vulnerability in the multiparty library, which is used to handle file uploads in web applications, can allow an attacker to crash the server. By sending a specially crafted file upload request, an attacker can trigger an unhandled error that shuts down the application process. This results in a denial of service, making the application unavailable to legitimate users.
Technical details
The multiparty library (versions 4.2.3 and earlier) fails to properly handle exceptions during the parsing of the 'filename*' parameter in 'Content-Disposition' headers. When a request contains malformed percent-encoding (e.g., '%FF'), the parser calls the JavaScript 'decodeURI' function without a try/catch block. This results in a 'URIError' that propagates as an uncaught exception, crashing the Node.js process. An unauthenticated remote attacker can exploit this by sending a single malicious multipart/form-data request. The issue is resolved in version 4.3.0.
Affected products
- pillarjs multiparty <= 4.2.3
Timeline
- 2026-05-12: disclosed: NVD publication date
- 2026-05-18: advisory: GitHub Advisory published
- 2026-05-18: patched: Version 4.3.0 released