Blake Embrey

**Name of the Vulnerable Software and Affected Versions** multiparty versions prior to 4.3.0 **Description** A denial of service issue exists due to regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload containing a long header value can cause regex matching to take several seconds, which blocks the event loop. This affects any service that accepts multipart uploads using this library. **Recommendations** Upgrade to version 4.3.0 or higher. Limit upload sizes at the proxy or gateway layer to reduce the attack surface.

**Name of the Vulnerable Software and Affected Versions** multiparty versions 4.2.3 and earlier **Description** A denial of service occurs when a multipart/form-data request is sent with a field name that collides with an inherited Object.prototype property, such as ` proto `, `constructor`, or `toString`. This causes the parser to invoke the `.push()` function on the inherited prototype value instead of an array, resulting in a TypeError that triggers an uncaught exception and crashes the process. This issue affects any service that accepts multipart uploads via multiparty. **Recommendations** Update to version 4.3.0 or higher.

**Name of the Vulnerable Software and Affected Versions** multiparty versions 4.2.3 and earlier **Description** A denial of service occurs due to an uncaught exception during the parsing of `multipart/form-data` requests. When a request contains a `Content-Disposition` header with a `filename*` parameter featuring malformed percent-encoding, the parser calls the `decodeURI()` function without a try/catch block. This results in a `URIError` that crashes the process, affecting any service that accepts multipart uploads via this library. **Recommendations** Update to version 4.3.0 or higher.