CVE-2026-3520

Vulnerability in multer (Node.js middleware) before version 2.3.0. A crafted multipart request with two fields can block the event loop, causing denial of service. Version 2.3.0 adds fieldArrayIndexLimit option to reject oversized array indexes.

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

multer before version 2.3.0 has a race condition vulnerability in file stream handling when an asynchronous fileFilter is used together with the fileSize limit. This allows bypassing the rejection of files exceeding the size limit.

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.

Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk, potentially exhausting disk space.

Multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. An attacker can exploit this to force allocation of deeply nested object structures, consuming CPU and memory.

Multer is a Node.js middleware for handling multipart/form-data. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.

Multer is a Node.js middleware for handling `multipart/form-data`. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping the connection during file upload, potentially causing resource exhaustion.