Executive brief
multiparty is a Node.js library used to parse file uploads and form data in web applications. An attacker can send a specially crafted upload request with extremely large headers that causes the server to consume all available memory and crash, taking the service offline. No data is compromised, but legitimate users lose access to the application.
Technical details
This is a denial-of-service vulnerability caused by uncontrolled memory allocation in the multipart header parsing logic. The library bounds field values (maxFieldsSize) and file bytes (maxFilesSize), but fails to limit the size of individual part headers. An unauthenticated attacker can craft a multipart/form-data request with a header that never terminates, forcing the parser to buffer all bytes until the process exhausts available memory and crashes. This applies even when all documented limits are configured. The vulnerability affects versions 2.1.0 through 4.3.0; it is fixed in version 4.3.1, which introduces a maxHeadersSize option (default 16 KB) to cap per-part header accumulation.
Affected products
- pillarjs multiparty 2.1.0 to 4.3.0
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Fixed in version 4.3.1