multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 0.5%
from disclosure to weapon0 days
Published on NVDMay 12
1st PoCMay 11
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to multiparty@4.3.0 or higher.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
multiparty · multipartypublic PoCs found — 1
githubgithub.com/Ser0n-ath/multiparty-CVE-2026-8161★ 0⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.