GHSA-65x3-rw7q-gx94

Suggest an improvement
Source
https://github.com/advisories/GHSA-65x3-rw7q-gx94
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-65x3-rw7q-gx94/GHSA-65x3-rw7q-gx94.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-65x3-rw7q-gx94
Aliases
  • CVE-2026-8159
Published
2026-05-18T17:40:10Z
Modified
2026-05-18T17:48:46.828357Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
multiparty vulnerable to ReDoS via filename parsing
Details

Impact

multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A multipart upload with a long header value containing !filename="1 repeated can cause regex matching to take seconds, blocking the event loop. Any service accepting multipart uploads via multiparty is affected.

Patches

Users should upgrade to multiparty@4.3.0 or higher.

Workarounds

None. Limiting upload sizes at the proxy/gateway layer reduces but does not eliminate the attack surface, since a small ~8 KB header is sufficient to trigger the vulnerable backtracking.

Resources

Database specific 
{
    "cwe_ids": [
        "CWE-1333"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-18T17:40:10Z",
    "nvd_published_at": "2026-05-12T10:16:48Z",
    "severity": "HIGH"
}
References

Affected packages

npm / multiparty

Package

Name
multiparty
View open source insights on deps.dev
Purl
pkg:npm/multiparty

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-65x3-rw7q-gx94/GHSA-65x3-rw7q-gx94.json"
last_known_affected_version_range 
"<= 4.2.3"