CVE-2026-5079
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. An attacker can exploit this to force allocation of deeply nested object structures, consuming CPU and memory.
Risk Assessment
The organization may experience significant performance issues, potentially leading to service unavailability. An attacker can leverage this vulnerability to conduct a DoS attack using a single crafted HTTP request.
Recommendation
It is recommended to upgrade to multer version 2.2.0 or 3.0.0-alpha.2 and configure the limits.fieldNestingDepth option to the minimum depth required by the application. Additionally, setting limits.fields to a reasonable value can help limit the number of fields an attacker can send per request.
Other vulnerabilities in multer
See all- CVE-2026-82333High
Vulnerability in multer (Node.js middleware) before version 2.3.0. A crafted multipart request with two fields can block the event loop, causing denial of service. Version 2.3.0 adds fieldArrayIndexLimit option to reject oversized array indexes.
- CVE-2026-77078High
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
- CVE-2026-77063Low
multer before version 2.3.0 has a race condition vulnerability in file stream handling when an asynchronous fileFilter is used together with the fileSize limit. This allows bypassing the rejection of files exceeding the size limit.
- CVE-2026-77037High
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
- CVE-2026-5038Medium
Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk, potentially exhausting disk space.
- CVE-2026-3520High
A vulnerability in Multer (node.js) prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.
- CVE-2026-3304High
Multer is a Node.js middleware for handling multipart/form-data. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.
- CVE-2026-2359High
Multer is a Node.js middleware for handling `multipart/form-data`. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping the connection during file upload, potentially causing resource exhaustion.
Original NVD description (English source)
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires. Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.