EUVD-2026-29440
GHSA-qxch-whhj-8956
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
2Blast Radius
ecosystem impact- 966 npm packages depend on multiparty (514 direct, 462 indirect)
Ecosystem-wide dependent count for version 4.3.0.
DescriptionNVD
multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to multiparty@4.3.0 or higher.
AnalysisAI
Denial of service in multiparty (Node.js multipart/form-data parser) versions ≤4.2.3 crashes Node.js processes when attackers send crafted form uploads with field names matching JavaScript Object prototype properties (__proto__, constructor, toString). CVSS 7.5 (High) with network vector and no authentication required. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all Node.js applications using multiparty ≤4.2.3 via dependency scanning (npm audit, Snyk, or equivalent). Within 7 days: Upgrade multiparty to version 4.3.0 or later across all affected services and conduct smoke testing of file upload functionality. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today