CVE-2026-77078
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Risk Assessment
A remote attacker can send a specially crafted multipart request, causing the Node.js process to crash and disrupting application availability (DoS).
Recommendation
Upgrade multer to version 2.3.0 or later. Restrict access to file upload routes and monitor network traffic.
Other vulnerabilities in multer
See all- CVE-2026-82333High
Vulnerability in multer (Node.js middleware) before version 2.3.0. A crafted multipart request with two fields can block the event loop, causing denial of service. Version 2.3.0 adds fieldArrayIndexLimit option to reject oversized array indexes.
- CVE-2026-77063Low
multer before version 2.3.0 has a race condition vulnerability in file stream handling when an asynchronous fileFilter is used together with the fileSize limit. This allows bypassing the rejection of files exceeding the size limit.
- CVE-2026-77037High
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
- CVE-2026-5038Medium
Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk, potentially exhausting disk space.
- CVE-2026-5079High
Multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. An attacker can exploit this to force allocation of deeply nested object structures, consuming CPU and memory.
- CVE-2026-3520High
A vulnerability in Multer (node.js) prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.
- CVE-2026-3304High
Multer is a Node.js middleware for handling multipart/form-data. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.
- CVE-2026-2359High
Multer is a Node.js middleware for handling `multipart/form-data`. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping the connection during file upload, potentially causing resource exhaustion.
Original NVD description (English source)
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.