Overview
About vulnerability
Impact
[email protected] and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition: filename*=utf-8'' header containing a malformed percent-encoding (e.g., %FF, %GG), the parser invokes decodeURI on the value without try/catch. The resulting URIError propagates as an uncaught exception and crashes the process. Any service accepting multipart uploads via multiparty is affected.
Patches
Users should upgrade to [email protected] or higher.
Workarounds
None.
Details
- Affected product:
- Express , connect , loopback , multiparty , strong-remoting
- Affected packages:
- multiparty @ 3.3.2 (+9 more)