https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-8162.htmlhttps://patchthecve.com/cve/CVE-2026-8162.htmlWed, 17 Jun 2026 11:03:34 +0000HIGH 7.5: multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a Content-Disposition header whose filename* parameter contains a malformed percent-encoding, the parser invokes decodeURI on the value without try/catch. Thehttps://patchthecve.com/cve/CVE-2026-8161.htmlhttps://patchthecve.com/cve/CVE-2026-8161.htmlWed, 17 Jun 2026 11:03:34 +0000HIGH 7.5: multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception. By sending a multipart/form-data request with a field name that collides with an inherited Object.prototype property such as __proto__, constructor, or toString, the parser invokes .push() on the inheritehttps://patchthecve.com/cve/CVE-2026-8159.htmlhttps://patchthecve.com/cve/CVE-2026-8159.htmlWed, 17 Jun 2026 11:03:34 +0000HIGH 7.5: multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop. Impact: any service