CVE-2026-8161
Description
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to [email protected] or higher.
How to fix
- pillarjs multiparty4.3.0 or later
- multiparty4.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pillarjs multiparty | v < 4.3.0 | 4.3.0 |
| multipartynpm | v < 4.3.0 | 4.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.