The vulnerability allows an attacker to send multipart/form‑data requests whose field names overlap with Object.prototype properties such as __proto__, constructor or toString. When multiparty parses these requests it invokes .push() on the prototype value rather than an array, causing a TypeError. The error bubbles up as an uncaught exception that crashes the Node.js process, effectively denying service to legitimate users.

Any Node.js application that uses the multiparty package version 4.2.3 or earlier is affected. The issue appears in the npm package multiparty, and all services that accept multipart uploads through this library are potentially impacted. Versions 4.3.0 and above include the fix.

The CVSS score of 7.5 indicates a high severity risk. The EPSS score was not provided in the CVE data, and the vulnerability is not listed in CISA's KEV catalog, which suggests it is not actively exploited in known campaigns. Based on the description, the attack vector is remote, delivered via crafted HTTP multipart requests, and requires the target to accept such uploads. Based on the description, it is inferred that an attacker does not need privileged access to trigger the crash, making the exploit potentially widespread for services that rely on multiparty.