multiparty Denial-of-Service Vulnerability via Prototype Pollution

A denial-of-service vulnerability has been identified in the multiparty package, specifically in versions through 4.2.3. The issue arises from prototype pollution, where a multipart/form-data request includes a field name that conflicts with an inherited Object.prototype property, such as __proto__, constructor, or toString. This collision causes the parser to mistakenly invoke the .push() method on the inherited prototype value instead of an array, leading to a TypeError. This error propagates as an uncaught exception, crashing the process. Any service that accepts multipart uploads using multiparty is vulnerable.

Impact

Exploitation of this vulnerability causes the process to crash, leading to a denial-of-service condition.

Remediation

Users are advised to upgrade to multiparty version 4.3.0 or higher.