highCVSS 7.5Vulnerability
CVE-2026-8161
### Impact [email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a `multipart/form-data` request with a field name that collides with an inherited `Object.prototype` property (e.g., `__proto__`, `constructor`, `toString`), the parser invokes `.push()` on the inherited prototype value rather than an array, throwing a `TypeError` that propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected. ### Patches Users should upgrade to [email protected] or higher. ### Workarounds None.
Properties
- summary
- multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception
- severity
- high
- epss_score
- 0.00533
- cvss_score
- 7.5
- retrieved_at
- 2026-10-07T08:52:52+00:00
- ghsa_published
- 2026-05-18T17:35:01Z
- source_url
- https://github.com/advisories/GHSA-qxch-whhj-8956
- ghsa_updated
- 2026-05-18T17:35:02Z
- ghsa_id
- GHSA-qxch-whhj-8956
- last_source
- FIRST EPSS
- cve_id
- CVE-2026-8161
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- epss_percentile
- 0.43115
Related Entities (6)
ENRICHED_BY (1)
→[Source]FIRST EPSS
AFFECTS (1)
→[Software]npm/multiparty
HAS_WEAKNESS (2)
→[Weakness]Uncaught Exception
→[Weakness]Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]npm/multiparty
Explore deeper with Ninja Signal's threat intelligence graph