CVE-2026-87908

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-87908", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "state": "PUBLISHED", "assignerShortName": "openjs", "dateReserved": "2026-09-09T15:07:30.466Z", "datePublished": "2026-09-11T06:37:51.216Z", "dateUpdated": "2026-09-11T15:54:32.991Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-09-11T06:37:51.216Z"}, "descriptions": [{"lang": "en", "value": "multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later."}]}], "affected": [{"vendor": "multiparty", "product": "multiparty", "defaultStatus": "unaffected", "versions": [{"versionType": "semver", "status": "affected", "version": "2.1.0", "lessThan": "4.3.1"}, {"versionType": "semver", "status": "unaffected", "version": "4.3.1"}], "packageURL": "pkg:npm/multiparty"}], "references": [{"url": "https://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "credits": [{"lang": "en", "type": "finder", "value": "Alfie Goh Li Heng"}, {"lang": "en", "type": "remediation developer", "value": "UlisesGascon"}, {"lang": "en", "type": "remediation reviewer", "value": "blakeembrey"}], "title": "multiparty vulnerable to Denial of Service via unbounded part-header accumulation", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "x_generator": {"engine": "cve-kit 1.0.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-11T15:53:17.487807Z", "id": "CVE-2026-87908", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-11T15:54:32.991Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-87908", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-11T15:53:17.487807Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-11T15:54:23.471Z"}}], "cna": {"title": "multiparty vulnerable to Denial of Service via unbounded part-header accumulation", "credits": [{"lang": "en", "type": "finder", "value": "Alfie Goh Li Heng"}, {"lang": "en", "type": "remediation developer", "value": "UlisesGascon"}, {"lang": "en", "type": "remediation reviewer", "value": "blakeembrey"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "multiparty", "product": "multiparty", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "4.3.1", "versionType": "semver"}, {"status": "unaffected", "version": "4.3.1", "versionType": "semver"}], "packageURL": "pkg:npm/multiparty", "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh"}, {"url": "https://cna.openjsf.org/security-advisories.html"}], "x_generator": {"engine": "cve-kit 1.0.0"}, "descriptions": [{"lang": "en", "value": "multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.", "supportingMedia": [{"type": "text/html", "value": "multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "shortName": "openjs", "dateUpdated": "2026-09-11T06:37:51.216Z"}}}, "cveMetadata": {"cveId": "CVE-2026-87908", "state": "PUBLISHED", "dateUpdated": "2026-09-11T15:54:32.991Z", "dateReserved": "2026-09-09T15:07:30.466Z", "assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb", "datePublished": "2026-09-11T06:37:51.216Z", "assignerShortName": "openjs"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/multiparty", "product": "multiparty", "vendor": "multiparty", "versions": [{"lessThan": "4.3.1", "status": "affected", "version": "2.1.0", "versionType": "semver"}, {"status": "unaffected", "version": "4.3.1", "versionType": "semver"}]}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later."}], "id": "CVE-2026-87908", "lastModified": "2026-09-16T19:40:00.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-87908", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-11T15:53:17.487807Z", "version": "2.0.3"}}]}, "published": "2026-09-11T07:16:47.937", "references": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://cna.openjsf.org/security-advisories.html"}, {"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "url": "https://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh"}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-770"}], "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "type": "Secondary"}]}

{"bugzilla": {"description": "multiparty: multiparty: Denial of Service via unbounded part-header accumulation", "id": "2531767", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2531767"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-1050", "details": ["multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the parser does not bound the amount of memory used while accumulating the headers of a single multipart part. An unauthenticated attacker can send a single request whose part carries a very large volume of header bytes, forcing the parser to buffer all of them and exhausting the process memory, which crashes the server. This is a denial of service with no confidentiality or integrity impact. The issue is fixed in multiparty 4.3.1, which caps the size of the accumulated part headers. Users should upgrade to multiparty 4.3.1 or later.", "A flaw was found in multiparty, a Node.js library for parsing multipart/form-data request bodies. The parser does not properly limit the memory used when accumulating headers of a single multipart part. An unauthenticated attacker can exploit this by sending a request with a large volume of header bytes, causing the parser to exhaust process memory and crash the server. This leads to a Denial of Service (DoS) with no impact on confidentiality or integrity."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-87908", "package_state": [{"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Affected", "package_name": "multiparty", "product_name": "Red Hat Fuse 7"}], "public_date": "2026-09-11T06:37:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-87908\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-87908\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh"], "statement": "This is an Important denial of service vulnerability affecting Red Hat JBoss Fuse, which incorporates the `multiparty` Node.js library. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted request with an excessive volume of multipart part headers. This leads to unbounded memory consumption and a server crash, but does not impact confidentiality or integrity.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.1.0,4.3.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.3.1"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "multiparty", "source": "cna", "vendor": "multiparty"}, "product": "multiparty", "vendor": "multiparty"}], "created": "2026-09-11T08:30:11.704173+00:00", "updated": "2026-09-24T02:15:14.749513+00:00", "vendors": ["multiparty", "multiparty$PRODUCT$multiparty"]}