CVE-2026-8162: Pillarjs multiparty denial of service via uncaught exception

CVE-2026-8162 · Severity: high · CVSS 7.5 · Published 2026-05-12

A vulnerability in the multiparty library, which is used to handle file uploads in web applications, can allow an attacker to crash the server. By sending a specially crafted file upload request, an attacker can trigger an unhandled error that shuts down the application process. This results in a denial of service, making the application unavailable to legitimate users.

Technologies: multiparty (npm), Pillarjs Multiparty. Vendors: npm, Pillarjs.

Quick answers

Is CVE-2026-8162 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8162 being exploited in the wild.
How severe is CVE-2026-8162?
High severity, with a CVSS score of 7.5, published 12 May 2026.
Which products and versions are affected?
multiparty (npm) SEMVER:introduced=0,fixed=4.3.0; Pillarjs Multiparty <= 4.2.3.
Is there a fix for CVE-2026-8162?
Yes. multiparty (npm): upgrade to 4.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8162 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8162?
Check whether you run multiparty (npm) or Pillarjs Multiparty at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • multiparty (npm): upgrade to 4.3.0 or later
    npm install multiparty@4.3.0

Technical details

The multiparty library (versions 4.2.3 and earlier) fails to properly handle exceptions during the parsing of the 'filename*' parameter in 'Content-Disposition' headers. When a request contains malformed percent-encoding (e.g., '%FF'), the parser calls the JavaScript 'decodeURI' function without a try/catch block. This results in a 'URIError' that propagates as an uncaught exception, crashing the Node.js process. An unauthenticated remote attacker can exploit this by sending a single malicious multipart/form-data request. The issue is resolved in version 4.3.0.

Affected products

  • pillarjs multiparty <= 4.2.3

Identifiers

  • CVE-2026-8162
  • GHSA-xh3c-6gcq-g4rv

Timeline

  • 2026-05-12: disclosed: NVD publication date
  • 2026-05-18: advisory: GitHub Advisory published
  • 2026-05-18: patched: Version 4.3.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.