multer vulnerable to Denial of Service via crafted multipart field names

Published September 8, 2026 CVE-2026-77078

A specially crafted web form request can crash a Node.js app using Multer. The remote attacker needs no login or user interaction.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 2.3.0Fix recorded 2 days ago
Affected versions
before 2.3.0
Weakness
CWE-248
Exploit likelihood
0.29% in 30 daysEPSS, higher than 21% of known flaws
Affects
Multer

How it works

  • A remote attacker sends one small web form request with two specially crafted field names.
  • The first makes Multer create an internal list at its maximum length.
  • The second forces that list beyond its allowed limit.
  • This triggers an error that Multer does not pass to the application's error handler.
  • The unhandled error terminates the Node.js process.

What to do

Run npm list multer inside each deployed Node.js project. Any listed version below 2.3.0 is affected. An empty result covers only the project where you ran the command.

Run this in the application environment you want to check:

npm list multer

Upgrade affected projects to Multer 2.3.0 or newer. Confirm npm list multer reports the corrected version afterward. The advisory lists no workaround.

Technical details

CVE-2026-77078 lets two crafted multipart/form-data field names trigger an uncaught RangeError inside the append-field dependency. Multer does not route this error to the application's handler, so the Node.js process terminates. Every Multer release before 2.3.0 is affected.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source