Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
[email protected] and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: limiting upload sizes at the proxy or gateway layer reduces but does not eliminate the attack surface, since a small header of around 8 KB is sufficient to trigger the vulnerable backtracking. Upgrade to [email protected] or higher.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 High-severity security fix in multiparty@4.3.0 just released! Patches CVE-2026-8159 — multiparty vulnerable to ReDoS via filename parsing https://github.com/pillarjs/multiparty/security/advisories/GHSA-65x3-rw7q-gx94
Post summary
Multiparty 4.3.0 has been released to patch CVE-2026-8159, a ReDoS vulnerability triggered by filename parsing; the advisory provides the fix via the new version.
CVE-2026-8159 Denial of Service via Regular Expression Backtracking in Multiparty 4.2.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-8159
Post summary
CVE-2026-8159 is a denial‑of‑service flaw caused by regex backtracking in Multiparty 4.2.3; the snippet does not include PoC, exploit code, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pillarjs | multiparty | - | node.js | - |