multiparty CVE-2026-8159

Upgrade multiparty to version 4.3.0 or higher immediately, which contains the patched regex pattern that eliminates catastrophic backtracking. Update package.json dependency and run npm update multiparty or yarn upgrade multiparty, then verify the installed version with npm list multiparty. Review transitive dependencies using npm ls multiparty to identify indirect inclusions through other packages like connect-multiparty or formidable-based middleware. If immediate upgrade is blocked by compatibility testing, implement compensating controls: deploy rate limiting at the reverse proxy layer (e.g., nginx limit_req or AWS WAF) to restrict requests per IP to 10-20/minute; add application-level request timeout middleware that aborts processing after 2-3 seconds using Node.js AbortController; configure web application firewalls to inspect and block multipart requests with Content-Disposition headers exceeding 4 KB; implement request queue depth limits to prevent event loop starvation under attack. Note these mitigations reduce but do not eliminate risk, as the 8 KB trigger is below most size limits, and sophisticated attackers can rotate IPs to bypass rate limiting. Long-term, eliminate this library if not actively maintained or migrate to alternatives like busboy (4.x+) or formidable that have addressed ReDoS concerns. Reference the OpenJS Foundation security advisories at https://cna.openjsf.org/security-advisories.html and OWASP ReDoS guidance at https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS for detection patterns.