GitHub Advisoryadvisory · npm

GHSA-wc9g-mqfw-jrwm multer vulnerable to Denial of Service via crafted multipart field names

HIGH Published 2026-09-08 Modified 2026-09-08 Official page ↗
Aliases
CVE-2026-77078
Ecosystem
npm
Packages
multer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-248
Reviewed
2026-09-08

Affected packages

• npm multer: < 2.3.0 → fixed in 2.3.0

Description

Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected. Patches Users should upgrade to `2.3.0`. Workarounds None.

Related

Alias · CVE (1)

  • CVE-2026-77078 multer is a middleware for handling multipart/form-data in Node.js. vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References