GHSA-65x3-rw7q-gx94
High · 7.5CVSS
7.5
EPSS
—
Published
May 18, 2026
CISA due date
—
The record
multiparty vulnerable to ReDoS via filename parsing
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | multiparty | 0 | 4.3.0 |
Related vulnerabilities
- CVE-2026-8159 multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular… Same vulnerability
- GHSA-xh3c-6gcq-g4rv multiparty vulnerable to Denial of Service via Uncaught Exception in filename* parameter… Also affects multiparty
- GHSA-qxch-whhj-8956 multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception Also affects multiparty
- CVE-2026-8162 multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught… Also affects multiparty
- CVE-2026-8161 multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught… Also affects multiparty
- CVE-2026-112901 Pillow is a Python imaging library. CWE-1333
- CVE-2026-106454 Twisted is an event-based framework for internet applications, supporting Python 3.6+. CWE-1333
- CVE-2026-77387 geopy is a geocoding library for Python. CWE-1333