CVE-2026-87908

multiparty, a Node.js library for parsing multipart/form-data request bodies, does not bound the memory used while accumulating the headers of a single multipart part in versions 2.1.0 through 4.3.0. An unauthenticated attacker can send a single request whose part carries an extremely large volume of header bytes, forcing the parser to buffer all of it until the Node.js process exhausts its memory and crashes. The impact is a denial of service only, with no confidentiality or integrity loss. Any Node.js application or service that parses multipart uploads with an affected multiparty version is affected, especially where such endpoints are reachable from the internet. No public proof-of-concept or confirmed in-the-wild exploitation is known, and the flaw is fixed in multiparty 4.3.1, which caps the size of accumulated part headers.

What to do: Upgrade multiparty to 4.3.1 or later, which caps the size of accumulated part headers. Until upgraded, cap request body sizes at a reverse proxy, load balancer, or framework layer and watch Node.js processes handling multipart endpoints for memory-exhaustion crashes. Audit dependency trees (e.g., npm ls multiparty or lockfile checks), since the package may be pulled in transitively.