multiparty version 4.2.3 and earlier parse the filename field of multipart requests using a regular expression. A maliciously crafted header can trigger catastrophic backtracking, causing the server to consume CPU for seconds and potentially block the event loop. The consequence for the affected service is a denial of service, preventing legitimate clients from completing requests or causing the node process to become unresponsive.

The vulnerability affects the multiparty library component in Node.js applications that accept multipart form data. Any application that imports multiparty@4.2.3 or lower is at risk; services that rely on older versions of the library are impacted.

The CVSS score of 7.5 reflects a high potential impact of a denial of service when an attacker can send a specially crafted multipart request. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog. The attack path requires the ability to submit multipart data to the vulnerable endpoint, which is typically accessible without authentication on publicly exposed upload APIs. Once the request is processed, the regular expression engine can consume significant CPU resources, degrading service availability for all users.