CVE-2026-8161

HighCVSS 7.5/10Last modified Nov 11, 2026

Description

multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to multiparty@4.3.0 or higher.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248 CWE-1321

Affected software

Vendor	Product	Versions
multiparty	multiparty	<= 4.2.3

References

https://cna.openjsf.org/security-advisories.htmlThird Party Advisory
https://github.com/pillarjs/multiparty/security/advisories/GHSA-qxch-whhj-8956Vendor Advisory

Timeline

Published: May 12, 2026
Last modified: Nov 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-81627.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request wit CVE-2026-816238.8IBM Guardium Data Protection 12.2 could allow an authenticated user to execute arbitrary commands with low user privileges on the system due CVE-2026-816247.5Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. CVE-2026-816258.8A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a CVE-2026-816268.6IBM Guardium Data Protection 12.2 is vulnerable to a SQL injection vulnerability in the Load Balancer Groups component. An unauthenticated u CVE-2026-816278.2A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the opti CVE-2026-81638.8The Infility Global WordPress plugin before 2.15.19 does not properly sanitize and escape some parameters before using them in SQL statement CVE-2026-816308.1The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmwar CVE-2026-816327.2Use of HTTP Request With Sensitive Query String vulnerability in team-alembic AshAuthenticationPhoenix allows someone able to read access lo CVE-2026-816336.9Improper Input Validation vulnerability in ash-project ash_graphql allows an unauthenticated client to crash a relay node(id: ...) query wit CVE-2026-816347.5In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow durin CVE-2026-816355.1A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a