highCVSS 7.5Vulnerability

CVE-2026-8161

### Impact [email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a field name that collides with an inherited `Object.prototype` property (e.g., `__proto__`, `constructor`, `toString`), the parser invokes `.push()` on the inherited prototype value rather than an array, throwing a `TypeError` that propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected. ### Patches Users should upgrade to [email protected] or higher. ### Workarounds None.

Properties

summary
multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
severity
high
epss_score
0.00473
cvss_score
7.5
ghsa_published
2026-05-18T17:35:01Z
source_url
https://github.com/advisories/GHSA-qxch-whhj-8956
ghsa_updated
2026-05-18T17:35:02Z
ghsa_id
GHSA-qxch-whhj-8956
cve_id
CVE-2026-8161
cvss_vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
is_ghsa_only
false
epss_percentile
0.39225

Related Entities (6)

ENRICHED_BY (1)

[Source]FIRST EPSS

AFFECTS (1)

[Software]npm/multiparty

HAS_WEAKNESS (2)

[Weakness]Uncaught Exception
[Weakness]Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

REPORTED_BY (1)

[Source]GitHub Advisory Database

VULNERABLE_TO (1)

[Software]npm/multiparty

Explore deeper with Ninja Signal's threat intelligence graph

CVE-2026-8161 (CVSS 7.5) — Ninja Signal Threat Intelligence | Ninja Signal