[Pkg-javascript-devel] Bug#1147414: node-multiparty: CVE-2026-87908

[Salvatore Bonaccorso]

Source: node-multiparty
Version: 4.3.0+~4.2.1-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for node-multiparty.

CVE-2026-87908[0]:
| multiparty is a Node.js library for parsing multipart/form-data
| request bodies. In versions from 2.1.0 up to but not including
| 4.3.1, the parser does not bound the amount of memory used while
| accumulating the headers of a single multipart part. An
| unauthenticated attacker can send a single request whose part
| carries a very large volume of header bytes, forcing the parser to
| buffer all of them and exhausting the process memory, which crashes
| the server. This is a denial of service with no confidentiality or
| integrity impact. The issue is fixed in multiparty 4.3.1, which caps
| the size of the accumulated part headers. Users should upgrade to
| multiparty 4.3.1 or later.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-87908
    https://www.cve.org/CVERecord?id=CVE-2026-87908
[1] https://github.com/pillarjs/multiparty/security/advisories/GHSA-5h46-2939-q3wh

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore