A malformed percent-encoding in the filename* parameter of a multipart/form-data request triggers an uncaught exception in the multiparty parser. The parser calls decodeURI without a try/catch block, so the resulting URIError propagates and causes the server process to crash. This is a denial of service vulnerability classified as CWE‑755.

The vulnerability exists in multiparty version 4.2.3 and all earlier releases. Any application that uses this library to handle multipart uploads is potentially exposed unless it has been upgraded to version 4.3.0 or later.

The CVSS score of 7.5 indicates a high severity risk. While EPSS data is not available and the issue is not listed in the CISA KEV catalog, the vulnerability can be exploited by an attacker who can send a crafted multipart request to the target service. The likely attack vector is external, directed at the upload endpoint, and does not require authentication. The impact is immediate denial of service due to process termination.