CVE-2026-8162

🗓️ 12 May 2026 09:05:12Reported by openjsType

cve🔗 web.nvd.nist.gov👁 60 Views🌐 WEB

Multiparty prior to 4.3.0 allows denial of service from an uncaught exception in filename* parsing; upgrade to 4.3.0.

Reporter	Title	Published	Views	Family All 27
attackerkb	CVE-2026-8162	12 May 202609:05	–	attackerkb
Circl	CVE-2026-8162	12 May 202609:10	–	circl
CNNVD	Multiparty security vulnerabilities	12 May 202600:00	–	cnnvd
Cvelist	CVE-2026-8162 multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing	12 May 202609:05	–	cvelist
Debian CVE	CVE-2026-8162	12 May 202609:05	–	debiancve
EUVD	EUVD-2026-29441	18 May 202617:35	–	euvd
Github Security Blog	multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter parsing	18 May 202617:35	–	github
Mend	CVE-2026-8162	12 May 202609:05	–	mend
NVD	CVE-2026-8162	12 May 202610:16	–	nvd
osv_clsa	CLSA-2026-1784682964 TuxCare security update for multiparty (3 CVEs)	4 Aug 202614:52	–	osv_clsa

NVD

Vulners

Node

pillarjs multipartyRange<4.3.0node.js

[
  {
    "vendor": "multiparty",
    "product": "multiparty",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "4.2.3",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.3.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "packageURL": "pkg:npm/multiparty"
  }
]

Source	Link
github	www.github.com/pillarjs/multiparty/security/advisories/GHSA-xh3c-6gcq-g4rv
cna	www.cna.openjsf.org/security-advisories.html

Parameter	Position	Path	Description	CWE
filename*	request body	/?file=...	A multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding causes an uncaught URIError exception, leading to a Denial of Service (DoS).	CWE-755

17 Jun 2026 11:03Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

EPSS0.00325

SSVC

CWE-755