CVE-2026-87908
Received Received - Intake

Denial of Service in multiparty Node.js Library

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: openjs

Description
multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-87908
EUVD
EUVD-2026-75976

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
nodejs multiparty From 2.1.0 (inc) to 4.3.1 (exc)
nodejs multiparty 4.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Denial of Service (DoS) vulnerability in the multiparty Node.js library, affecting versions from 2.1.0 up to but not including 4.3.1. The parser fails to limit memory usage while accumulating headers for a single multipart part. An attacker can send a request with an extremely large part header, causing the server to exhaust memory and crash. The issue has no confidentiality or integrity impact.

Detection Guidance

To detect this vulnerability, monitor for crashes or high memory usage in Node.js applications using the multiparty library versions 2.1.0 to 4.3.0. Check application logs for out-of-memory errors or excessive memory consumption during file upload requests. Use tools like 'top' or 'htop' to observe memory usage spikes when processing multipart requests.

Impact Analysis

The vulnerability allows unauthenticated attackers to crash your server by sending a single malicious request. This results in downtime and service unavailability. It does not expose data or allow unauthorized access, but it severely disrupts normal operations.

Compliance Impact

This DoS vulnerability primarily impacts availability, which is a key requirement under GDPR (Article 32) and HIPAA (Security Rule). Downtime could lead to violations if systems are unavailable when needed for data processing or access. However, no data breach occurs.

Mitigation Strategies

Immediately upgrade the multiparty library to version 4.3.1 or later. If upgrading is not possible, implement a reverse proxy to limit request body sizes and add rate limiting to prevent large header attacks. Monitor network traffic for unusually large multipart requests as a temporary measure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-87908. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart