CVE-2026-8159 multiparty vulnerable to ReDoS via filename parsing
Attackers can cause denial of service in Node.js applications using multiparty by sending crafted multipart uploads that trigger regex backtracking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8159?
CVE-2026-8159 is a high-severity denial of service vulnerability in multiparty, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: limiting upload sizes at the proxy or gateway layer reduces but does not eliminate the attack surface, since a small header of around 8 KB is sufficient to trigger the vulnerable backtracking. Upgrade to [email protected] or higher.
Weakness: CWE-1333
Which versions are affected by CVE-2026-8159?
2 open source packages ship an affected version, including multiparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
multiparty npm | All versions | 4.3.0 |
multiparty npm | All versions | 4.3.0 |
Products include Pillarjs Multiparty.
How do I fix CVE-2026-8159?
Upgrade multiparty to 4.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-8159 being exploited?
There is no known exploitation of CVE-2026-8159 in the wild and no public exploit code.
Other vulnerabilities in multiparty
Sources
Also known as CLSA-2026-1785291243, DEBIAN-CVE-2026-8159, GHSA-65x3-rw7q-gx94, ROOT-APP-NPM-CVE-2026-8159, UBUNTU-CVE-2026-8159.