VulnSocial

CVE-2026-8161Patch(pillarjs / multiparty)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch pillarjs multiparty systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none. Upgrade to [email protected] or higher.

pillarjs CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-248CWE-1321

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • multiparty

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
pillarjs
Products
multiparty

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-05-12: 1Patch / Workaround · 2026-05-12: 1Technical Details · 2026-05-12: 105-12
Signal classification1 categories
Patch
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • Ulises Gascón@kom_256
    Patch

    🚨 High-severity security fix in multiparty@4.3.0 just released! Patches CVE-2026-8161 — multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception https://github.com/pillarjs/multiparty/security/advisories/GHSA-qxch-whhj-8956

    Post summary

    A new security fix for [email protected] has been released, patching CVE‑2026‑8161 which caused a denial‑of‑service via prototype pollution that triggered an uncaught exception.

    00010168
    5.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apppillarjsmultiparty-node.js-

Explore more

Back to dashboardpillarjs CVEsmultiparty vulnerabilities