The vulnerability arises from an unbounded accumulation of multipart part headers within the multiparty Node.js library. The parser can buffer an arbitrary number of header bytes before processing a request, and a malicious request can cause the library to consume all available memory. The result is that the hosting process crashes, denying service to legitimate users. The weakness is a resource exhaustion flaw, specifically lack of bounds checking during part-header accumulation, classified as CWE‑400 and CWE‑770.

Affected software is the multiparty Node.js library, versions 2.1.0 through 4.3.1 exclusive. Any application that uses these versions to parse multipart/form‑data requests is susceptible. The vulnerability is independent of authentication level; an unauthenticated attacker can trigger it by sending a crafted HTTP request.

The CVSS score of 7.5 indicates a high risk of service disruption. The EPSS score is currently not available, so the precise likelihood is unknown, but the flaw is actively exploitable in the wild as it requires only a single HTTP request. The vulnerability is not yet listed in the CISA KEV catalog, so it has not been confirmed as a large‑scale exploited vulnerability. The attack vector is likely remote, through a normal HTTP request to a web application that employs the vulnerable multipart parser._