PT-2026-39998 · Npm · Multipart

Blake Embrey + 2 · Published 2026-05-12 · Updated 2026-05-18 · CVE-2026-8162

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions multiparty versions 4.2.3 and earlier

Description A denial of service occurs due to an uncaught exception during the parsing of multipart/form-data requests. When a request contains a Content-Disposition header with a filename* parameter featuring malformed percent-encoding, the parser calls the decodeURI() function without a try/catch block. This results in a URIError that crashes the process, affecting any service that accepts multipart uploads via this library.

Recommendations Update to version 4.3.0 or higher.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-755

Related Identifiers

CVE-2026-8162

GHSA-XH3C-6GCQ-G4RV

Affected Products

Multipart

References · 10

• https://github.com/pillarjs/multiparty/security/advisories/GHSA-xh3c-6gcq-g4rv · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-8162 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xh3c-6gcq-g4rv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-8162 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-8162 · Vendor Advisory
• https://github.com/pillarjs/multiparty · Note
• https://github.com/pillarjs/multiparty/releases/tag/v4.3.0 · Note
• https://twitter.com/kom_256/status/2054127127377666388 · Twitter Post
• https://t.me/CVEtracker/53494 · Telegram Post
• https://cna.openjsf.org/security-advisories.html · Note