CVE-2026-8162: Pillarjs Multiparty DoS Vulnerability

CVE-2026-8162 Overview

CVE-2026-8162 affects the multiparty Node.js module versions 4.2.3 and earlier. The library is widely used to parse multipart/form-data HTTP requests, including file uploads. Attackers can crash any process accepting multipart uploads by sending a single crafted request. The flaw stems from an uncaught URIError raised by decodeURI when processing a malformed filename* parameter in a Content-Disposition header. Maintainers addressed the issue in multiparty@4.3.0.

Critical Impact
Unauthenticated remote attackers can crash any HTTP service that accepts multipart uploads through multiparty, producing a denial of service with a single request.

Affected Products

pillarjs/multiparty versions 4.2.3 and lower
Node.js applications consuming multiparty as a direct dependency
Express, Connect, and other frameworks using multiparty for upload handling

Discovery Timeline

2026-05-12 - CVE-2026-8162 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8162

Vulnerability Analysis

The vulnerability is an Improper Handling of Exceptional Conditions [CWE-755] flaw in the multiparty multipart parser. When parsing a Content-Disposition header, the parser extracts the filename* parameter, which follows RFC 5987 percent-encoding rules. The parser passes that value directly to decodeURI without wrapping the call in try/catch.

If the percent-encoded sequence is malformed, decodeURI throws a URIError. The exception escapes the request handler and propagates to the Node.js event loop. Without an uncaughtException listener, the Node.js process terminates. A single unauthenticated HTTP request is sufficient to crash the worker, producing a denial of service across the affected service.

Root Cause

The root cause is missing exception handling around a parser routine that processes untrusted input. The decodeURI function rejects malformed percent-encoding by throwing, and the multiparty header parser did not anticipate that failure mode. Because Node.js terminates on uncaught exceptions by default, the parsing error escalates to a full process crash.

Attack Vector

Exploitation requires only network access to any endpoint that hands incoming multipart/form-data requests to multiparty. The attacker sends a POST request containing a Content-Disposition header with a filename* value that includes an invalid percent-encoded sequence, such as a lone % or %ZZ. The parser invokes decodeURI on the value, the call throws, and the process exits. No authentication, user interaction, or privileged access is required. See the GitHub Security Advisory GHSA-xh3c-6gcq-g4rv for additional technical detail.

Detection Methods for CVE-2026-8162

Indicators of Compromise

Repeated unexpected Node.js process exits or worker restarts correlated with inbound multipart/form-data requests
HTTP request logs containing Content-Disposition headers with malformed filename* values, such as filename*=UTF-8''% or stray percent characters
Stack traces in application logs referencing URIError: URI malformed originating from multiparty header parsing

Detection Strategies

Inventory all Node.js services and identify those with multiparty@<=4.2.3 in package-lock.json or yarn.lock using npm ls multiparty
Configure a web application firewall (WAF) rule to flag Content-Disposition headers containing invalid percent-encoding sequences
Enable Node.js process.on('uncaughtException') logging to capture URIError events with full stack traces for forensic review

Monitoring Recommendations

Alert on abnormal rates of process restarts, container OOM/crash events, or load balancer health-check failures on upload-handling services
Monitor HTTP 5xx response spikes correlated with multipart/form-data content types
Track outbound dependency advisories from the OpenJS Foundation Security Advisories feed for further multiparty updates

How to Mitigate CVE-2026-8162

Immediate Actions Required

Upgrade multiparty to version 4.3.0 or later in every affected service
Run npm audit or yarn audit across all Node.js projects and remediate any flagged multiparty advisories
Restart all Node.js workers after upgrading to ensure the patched module is loaded into memory
Deploy a WAF rule to drop requests with malformed filename* percent-encoding until patches are applied

Patch Information

The multiparty maintainers fixed the issue in version 4.3.0 by wrapping the decodeURI call in a try/catch block and rejecting the offending parameter rather than throwing. Refer to the GitHub Security Advisory GHSA-xh3c-6gcq-g4rv for the official remediation guidance.

Workarounds

No vendor-supplied workaround exists; upgrading to multiparty@4.3.0 is the only complete fix
As a temporary compensating control, place a reverse proxy or WAF in front of the application to reject requests with malformed Content-Disposition percent-encoding
Add a global process.on('uncaughtException') handler to keep workers alive, with the understanding that this does not address the underlying parsing flaw

bash

# Upgrade multiparty to the patched release
npm install multiparty@^4.3.0 --save

# Verify the resolved version across the dependency tree
npm ls multiparty

# Audit the project for related advisories
npm audit --production