Byambadalai Sumiya

**Name of the Vulnerable Software and Affected Versions** microtar version 0.1.0 **Description** A stack-based buffer overflow occurs in the `raw to header()` function within src/microtar.c. This issue allows attackers to corrupt adjacent stack memory by providing a specially crafted TAR archive containing `name` or `linkname` fields that are not null-terminated. The function utilizes `strcpy()` to copy 100-byte ustar format fields; when these fields lack null terminators, it can result in writes of up to 355 bytes into a 100-byte destination buffer. This happens when the `mtar open()`, `mtar find()`, or `mtar read header()` functions process the malicious archive. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** multiparty versions 4.2.3 and earlier **Description** A denial of service occurs when a multipart/form-data request is sent with a field name that collides with an inherited Object.prototype property, such as ` proto `, `constructor`, or `toString`. This causes the parser to invoke the `.push()` function on the inherited prototype value instead of an array, resulting in a TypeError that triggers an uncaught exception and crashes the process. This issue affects any service that accepts multipart uploads via multiparty. **Recommendations** Update to version 4.3.0 or higher.

**Name of the Vulnerable Software and Affected Versions** multiparty versions 4.2.3 and earlier **Description** A denial of service occurs due to an uncaught exception during the parsing of `multipart/form-data` requests. When a request contains a `Content-Disposition` header with a `filename*` parameter featuring malformed percent-encoding, the parser calls the `decodeURI()` function without a try/catch block. This results in a `URIError` that crashes the process, affecting any service that accepts multipart uploads via this library. **Recommendations** Update to version 4.3.0 or higher.