Description
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser invokes decodeURI on the value without try/catch. The resulting URIError propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to [email protected] or higher.
Affected products
pillarjs: multiparty
References2
- github.com/pillarjs/multiparty/security/advisories/GHSA-xh3c-6g… Vendor Advisory
- cna.openjsf.org/security-advisories.html Third Party Advisory
Metrics
- CVSS 3.1
-
7.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 0% percentile: 26 · as of 14 November 2026
- CWE
- CWE-755
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.