The vulnerability arises from an unbounded accumulation of multipart part headers within the multiparty Node.js library. The parser can buffer an arbitrary number of header bytes before processing a request, and a malicious request can cause the library to consume all available memory. The result is that the hosting process crashes, denying service to legitimate users. The weakness is a resource exhaustion flaw, specifically lack of bounds checking during part-header accumulation, classified as CWE‑400, CWE‑770, and CWE‑1050.

Affected software is the multiparty Node.js library, versions 2.1.0 through 4.3.1 exclusive. Any application that uses these versions to parse multipart/form‑data requests is susceptible. The vulnerability is independent of authentication level; an unauthenticated attacker can trigger it by sending a crafted HTTP request.

The CVSS score of 7.5 indicates a high risk of service disruption. The EPSS score is 0.00297, indicating a very low probability of exploitation, but the flaw is still actively exploitable in the wild as it requires only a single HTTP request. The vulnerability is not yet listed in the CISA KEV catalog, so it has not been confirmed as a large‑scale exploited vulnerability. The attack vector is likely remote, through a normal HTTP request to a web application that employs the vulnerable multipart parser.