CVE-2026-8161 multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
An attacker can crash the application by sending a crafted multipart request that triggers a prototype pollution-induced uncaught exception.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8161?
CVE-2026-8161 is a high-severity denial of service vulnerability in multiparty, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to [email protected] or higher.
Which versions are affected by CVE-2026-8161?
2 open source packages ship an affected version, including multiparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
multiparty npm | All versions | 4.3.0 |
multiparty npm | All versions | 4.3.0 |
Products include Pillarjs Multiparty.
How do I fix CVE-2026-8161?
Upgrade multiparty to 4.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-8161 being exploited?
There is no known exploitation of CVE-2026-8161 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in multiparty
Sources
Also known as DEBIAN-CVE-2026-8161, GHSA-qxch-whhj-8956, ROOT-APP-NPM-CVE-2026-8161, UBUNTU-CVE-2026-8161.