PT-2026-39997 · Npm · Multipart

Blake Embrey + 5 · Published 2026-05-12 · Updated 2026-05-18 · CVE-2026-8161

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions multiparty versions 4.2.3 and earlier

Description A denial of service occurs when a multipart/form-data request is sent with a field name that collides with an inherited Object.prototype property, such as proto, constructor, or toString. This causes the parser to invoke the .push() function on the inherited prototype value instead of an array, resulting in a TypeError that triggers an uncaught exception and crashes the process. This issue affects any service that accepts multipart uploads via multiparty.

Recommendations Update to version 4.3.0 or higher.

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-248

Related Identifiers

CVE-2026-8161

GHSA-QXCH-WHHJ-8956

Affected Products

Multipart

References · 10

• https://github.com/pillarjs/multiparty/security/advisories/GHSA-qxch-whhj-8956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8161 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8161 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qxch-whhj-8956 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8161 · Vendor Advisory
• https://github.com/pillarjs/multiparty/releases/tag/v4.3.0 · Note
• https://github.com/pillarjs/multiparty · Note
• https://cna.openjsf.org/security-advisories.html · Note
• https://twitter.com/kom_256/status/2054123146312049076 · Twitter Post
• https://t.me/CVEtracker/53493 · Telegram Post