EUVD-2026-29439
GHSA-65x3-rw7q-gx94
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Blast Radius
ecosystem impact- 966 npm packages depend on multiparty (514 direct, 462 indirect)
Ecosystem-wide dependent count for version 4.3.0.
DescriptionNVD
multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: limiting upload sizes at the proxy or gateway layer reduces but does not eliminate the attack surface, since a small header of around 8 KB is sufficient to trigger the vulnerable backtracking. Upgrade to multiparty@4.3.0 or higher.
AnalysisAI
Regular expression denial of service in multiparty (npm package) versions 4.2.3 and below allows remote unauthenticated attackers to block the Node.js event loop for seconds via crafted Content-Disposition headers in multipart uploads. The vulnerability triggers catastrophic backtracking in the filename parameter parser with headers as small as 8 KB. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Audit all Node.js applications for multiparty package usage via 'npm list multiparty' and document current versions in use. Within 7 days: Upgrade multiparty to version 4.3.0 or later across all development, staging, and production environments, and test file upload functionality end-to-end. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today