CVE-2026-8162 multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing
An attacker can crash the application by sending a malformed multipart request, causing a denial of service in services using the multiparty library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-8162?
CVE-2026-8162 is a high-severity denial of service vulnerability in multiparty, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser invokes decodeURI on the value without try/catch. The resulting URIError propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to [email protected] or higher.
Weakness: CWE-755
Which versions are affected by CVE-2026-8162?
2 open source packages ship an affected version, including multiparty. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
multiparty npm | All versions | 4.3.0 |
multiparty npm | All versions | 4.3.0 |
Products include Pillarjs Multiparty.
How do I fix CVE-2026-8162?
Upgrade multiparty to 4.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-8162 being exploited?
There is no known exploitation of CVE-2026-8162 in the wild and no public exploit code.
Other vulnerabilities in multiparty
Sources
Also known as DEBIAN-CVE-2026-8162, GHSA-xh3c-6gcq-g4rv, ROOT-APP-NPM-CVE-2026-8162, UBUNTU-CVE-2026-8162.