Technical impact
The vulnerability arises from an unbounded accumulation of multipart part headers within the multiparty Node.js library. The parser can buffer an arbitrary number of header bytes before processing a request, and a malicious request can cause the library to consume all available memory. The result is that the hosting process crashes, denying service to legitimate users. The weakness is a resource exhaustion flaw, specifically lack of bounds checking during part-header accumulation, classified as CWE‑400, CWE‑770, and CWE‑1050.
Affected Systems
Affected software is the multiparty Node.js library, versions 2.1.0 through 4.3.1 exclusive. Any application that uses these versions to parse multipart/form‑data requests is susceptible. The vulnerability is independent of authentication level; an unauthenticated attacker can trigger it by sending a crafted HTTP request.
Risk and Exploitability
The CVSS score of 7.5 indicates a high risk of service disruption. The EPSS score is 0.00297, indicating a very low probability of exploitation, but the flaw is still actively exploitable in the wild as it requires only a single HTTP request. The vulnerability is not yet listed in the CISA KEV catalog, so it has not been confirmed as a large‑scale exploited vulnerability. The attack vector is likely remote, through a normal HTTP request to a web application that employs the vulnerable multipart parser.
