Description

multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-11T07:16:47.937Z",
  "pubdate": "2026-09-11T07:16:47.937Z",
  "executiveSummary": "The multiparty Node.js library, versions 2.1.0 through 4.3.0, contains a vulnerability involving improper resource management during the parsing of multipart/form-data request bodies.\nThe flaw stems from a lack of memory bounds when accumulating headers for individual multipart parts, allowing an unauthenticated attacker to trigger a Denial of Service (DoS) condition.\nBy transmitting a crafted request containing an excessive volume of header data, an attacker can force the application to allocate memory until the process exhausts available system resources, resulting in a service crash.\nThis vulnerability carries significant availability risks for applications utilizing the affected library, as it requires no prior authentication and can be executed remotely over the network.\nThe impact is strictly limited to availability, with no associated risk to data confidentiality or integrity. System administrators are advised to prioritize updating to version 4.3.1 or later to implement the necessary header size constraints.",
  "technicalDetails": "The root cause of this vulnerability is an unbounded buffer accumulation pattern within the multipart parsing logic of the multiparty library. When processing an incoming multipart/form-data stream, the parser attempts to collect and store the header block for each part as it is identified.\nIn versions 2.1.0 through 4.3.0, the implementation fails to verify the size of the incoming header bytes against a maximum threshold before appending them to the internal memory buffer.\nThe attack vector involves a malicious actor crafting an HTTP request with a multipart body where at least one part contains an extremely long header section. Because the parser lacks a constraint mechanism, it continuously expands its memory allocation to hold these headers as they arrive from the network buffer.\nAs the attacker sends a high volume of bytes for the header, the Node.js process experiences rapid memory growth. This behavior leads to heap exhaustion, eventually triggering an unhandled exception or causing the process to be terminated by the operating system’s Out-Of-Memory (OOM) killer.\nBecause this process occurs during the initial header parsing phase, the attack is effective even if the request payload body itself is never fully transmitted. This makes the exploit highly efficient for the attacker, as it requires minimal bandwidth to maintain the connection while maximizing resource consumption on the target server.\nThe exploitation does not require authentication or elevated privileges, making any public-facing endpoint utilizing a vulnerable version of multiparty susceptible to remote DoS attacks. This issue effectively bypasses traditional request size limiting middleware if those middlewares only inspect the total body size rather than individual part header size.\nThe vulnerability is resolved in version 4.3.1, which introduces a hard cap on the size of accumulated part headers, ensuring that excessive header data is rejected before it can lead to memory exhaustion. By enforcing this limit, the parser prevents the uncontrolled buffer growth that previously enabled the DoS condition."
}