CVE-2026-87908: multiparty Node.js Library DOS Vulnerability

CVE-2026-87908 Overview

CVE-2026-87908 is a denial of service vulnerability in multiparty, a Node.js library for parsing multipart/form-data request bodies. Versions from 2.1.0 up to but not including 4.3.1 do not bound the memory used while accumulating headers of a single multipart part. An unauthenticated attacker can send one request whose part carries a very large volume of header bytes. The parser buffers all of them, exhausts process memory, and crashes the server. The issue is tracked under CWE-400: Uncontrolled Resource Consumption and fixed in multiparty 4.3.1.

Critical Impact
A single unauthenticated HTTP request can crash any Node.js service using vulnerable multiparty versions, causing service-wide outage.

Affected Products

multiparty Node.js package versions 2.1.0 through 4.3.0
Node.js applications parsing multipart/form-data with vulnerable multiparty
Downstream frameworks and middleware bundling vulnerable multiparty releases

Discovery Timeline

2026-09-11 - CVE-2026-87908 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-87908

Vulnerability Analysis

The multiparty parser reads each multipart part header-by-header before delivering the part to the application. In versions 2.1.0 through 4.3.0, the accumulator that stores header bytes for a single part has no upper bound. An attacker can craft one HTTP request where a single part's header section is arbitrarily large. The parser continues to buffer every header byte in memory until Node.js triggers an out-of-memory condition and the process terminates. Because the attack requires no authentication and completes in a single request, it targets availability directly with no confidentiality or integrity impact.

Root Cause

The root cause is missing input size validation on accumulated part headers. The parser did not enforce a maximum on the total bytes gathered before header parsing completes. This mirrors the class of algorithmic and resource exhaustion flaws catalogued under CWE-400. The fix in version 4.3.1 caps the size of the accumulated part headers, so the parser rejects a part instead of buffering unbounded data.

Attack Vector

Exploitation occurs remotely over the network against any HTTP endpoint that routes multipart/form-data uploads through vulnerable multiparty. The attacker submits a request whose part header block contains a very large number of header lines or extremely long header values. The Node.js worker process consumes memory linearly with the header bytes received and terminates when the runtime memory limit is reached. Because Node.js applications are typically single-process per worker, one request can take down each worker in sequence until the service is unavailable. Refer to the GitHub Security Advisory GHSA-5h46-2939-q3wh for the upstream description.

Detection Methods for CVE-2026-87908

Indicators of Compromise

Repeated Node.js worker crashes with JavaScript heap out of memory or FATAL ERROR: Reached heap limit messages in application logs.
Sudden RSS memory spikes on Node.js processes handling multipart/form-data uploads.
HTTP requests to upload endpoints containing unusually large header sections within multipart parts.
Process restart loops managed by pm2, systemd, or Kubernetes shortly after a single inbound request.

Detection Strategies

Inventory Node.js applications and their dependency trees for multiparty versions below 4.3.1 using npm ls multiparty or software composition analysis tooling.
Inspect reverse proxy and web application firewall logs for oversized request bodies or abnormal header-to-body ratios on multipart endpoints.
Correlate application crash events with the immediately preceding HTTP request to identify malicious payloads.

Monitoring Recommendations

Alert on Node.js process termination events with out-of-memory exit codes on hosts running upload services.
Track request body size distributions per endpoint and flag statistical outliers on multipart routes.
Monitor container restart counts and pod eviction events tied to memory pressure on affected workloads.

How to Mitigate CVE-2026-87908

Immediate Actions Required

Upgrade multiparty to version 4.3.1 or later in all affected Node.js projects and rebuild deployment artifacts.
Audit direct and transitive dependencies with npm audit or equivalent tooling and rebuild lockfiles.
Restart Node.js services after patching to ensure the vulnerable module is unloaded from memory.

Patch Information

The maintainers fixed the issue in multiparty 4.3.1 by capping the size of accumulated part headers. Users should upgrade to multiparty 4.3.1 or later. See the GitHub Security Advisory GHSA-5h46-2939-q3wh and the OpenJS Foundation Security Advisories for release details.

Workarounds

Place a reverse proxy such as nginx or a WAF in front of Node.js services and enforce strict limits on request header size and total request size for multipart endpoints.
Restrict access to upload endpoints with authentication and rate limiting until the patched version is deployed.
Run Node.js workers under a process supervisor with automatic restart and per-process memory limits to reduce blast radius during exploitation attempts.

bash

# Upgrade multiparty to a patched version
npm install multiparty@^4.3.1
npm ls multiparty

# Example nginx limits for upstream Node.js upload endpoints
# client_max_body_size 10m;
# large_client_header_buffers 4 8k;