# What changed in multiparty

> 8 changes in multiparty 4 from its official release notes, upgrade guides and advisories: 4 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/multiparty/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## multiparty 4

### Security

- Fixes the vulnerability identified as CVE-2026-87908. (4.3.1) — [release notes](https://github.com/pillarjs/multiparty/releases/tag/v4.3.1)
- multiparty: Denial of Service via Prototype Pollution leads to Uncaught Exception (4.3.0) — [security advisory](https://github.com/advisories/GHSA-QXCH-WHHJ-8956)
- multiparty vulnerable to ReDoS via filename parsing (4.3.0) — [security advisory](https://github.com/advisories/GHSA-65X3-RW7Q-GX94)
- Fixes three security vulnerabilities identified as CVE-2026-8162, CVE-2026-8161, and CVE-2026-8159. (4.3.0) — [release notes](https://github.com/pillarjs/multiparty/releases/tag/v4.3.0), [security advisory](https://github.com/advisories/GHSA-XH3C-6GCQ-G4RV)

### New APIs and options

- Adds an option to restrict header size. (4.3.1) — [release notes](https://github.com/pillarjs/multiparty/releases/tag/v4.3.1)

### Fixes and other changes

- Handles chunked base64 transfer encoding. (4.3.1) — [release notes](https://github.com/pillarjs/multiparty/releases/tag/v4.3.1)
- Fixes decoding filenames from Chrome and Firefox. (4.3.0) — [release notes](https://github.com/pillarjs/multiparty/releases/tag/v4.3.0)
- Fixes form parsing when no part event listener is added. (4.3.0) — [release notes](https://github.com/pillarjs/multiparty/releases/tag/v4.3.0)