CVE-2026-87908

Name of the Vulnerable Software and Affected Versions multiparty versions 2.1.0 through 4.3.0

Description multiparty is a Node.js library used for parsing multipart/form-data request bodies. The parser fails to limit the memory used when accumulating headers for a single multipart part. An unauthenticated attacker can exploit this by sending a request containing an excessive volume of header bytes, forcing the parser to buffer the data and exhaust process memory, resulting in a denial of service that crashes the server.

Recommendations Upgrade to version 4.3.1 or later.