CVE-2026-8161: multiparty Uncaught Exception
Vulnerability summary
CVE-2026-8161 is a high (CVSS 7.5) Uncaught Exception vulnerability in multiparty. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.1% of scored vulnerabilities.
Timeline
- 12-05-2026PublishedVulnerability first disclosed.
- 12-05-2026Last modifiedVulnerability information updated.
Description
multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to multiparty@4.3.0 or higher.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
+0.06 pp
From 0.47% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-248Uncaught ExceptionAn exception is thrown from a function, but it is not caught.
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
Affected systems
Debian1 product
- node-multipartyAll versions (No fix recorded) | < 4.3.0-1
Multiparty1 product
- multiparty≤ 4.2.3
Npm1 product
- multiparty< 4.3.0
Pillarjs1 product
- multiparty< 4.3.0
Ubuntu1 product
- node-multipartyAll versions (No fix recorded)
5 vendors · 5 products
