Improper Handling of Exceptional Conditions

Summary

multiparty versions through 4.2.3 are vulnerable to Denial-of-Service (DoS) via uncaught exception. By sending a 'multipart/form-data' request with a 'Content-Disposition' header whose 'filename*' parameter contains a malformed percent-encoding, the parser invokes 'decodeURI' on the value without try/catch. The resulting 'URIError' propagates as an uncaught exception and crashes the process. Impact: any service accepting multipart uploads via multiparty is affected. Workarounds: none.