chore(deps): update dependency multiparty to v4.3.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
multiparty	4.2.3 → 4.3.0

---

multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception

CVE-2026-8161 / GHSA-qxch-whhj-8956

More information

Details

Impact

multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property (e.g., __proto__, constructor, toString), the parser invokes .push() on the inherited prototype value rather than an array, throwing a TypeError that propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected.

Patches

Users should upgrade to multiparty@4.3.0 or higher.

Workarounds

None.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/pillarjs/multiparty/security/advisories/GHSA-qxch-whhj-8956
• https://nvd.nist.gov/vuln/detail/CVE-2026-8161
• https://cna.openjsf.org/security-advisories.html
• https://github.com/pillarjs/multiparty/releases/tag/v4.3.0
• https://github.com/advisories/GHSA-qxch-whhj-8956

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

pillarjs/multiparty (multiparty)

v4.3.0

Compare Source

Important: Security

• Security fix for CVE-CVE-2026-8162 (GHSA-xh3c-6gcq-g4rv)
• Security fix for CVE-2026-8161 (GHSA-qxch-whhj-8956)
• Security fix for CVE-CVE-2026-8159 (GHSA-65x3-rw7q-gx94)

Fixed

• Fix decoding filenames from Chrome/Firefox a786412
• Fix form parsing when no part event listener added cb2421f

---

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cloudflare-workers-and-pages]

Deploying node-js-server with    Cloudflare Pages

Latest commit:	1c40ee4
Status:	✅  Deploy successful!
Preview URL:	https://1a3d0992.node-js-server.pages.dev
Branch Preview URL:	https://renovate-npm-multiparty-vuln.node-js-server.pages.dev

View logs

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request