Multiparty vulnerabilities
We track 4 vulnerabilities in Multiparty products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 11, 2026.
Latest Multiparty vulnerabilities
- 7.5 High severity
multiparty: Uncontrolled Resource Consumption
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthentica
- 7.5 High severity
multiparty: Improper Handling of Exceptional Conditions
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser invokes decod
- 7.5 High severity
multiparty: Uncaught Exception
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, th
- 7.5 High severity
multiparty: Inefficient Regular Expression Complexity
[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, bloc