Summary
multer vulnerable to Denial of Service via crafted multipart field names
Advisory details
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
References
- https://github.com/advisories/GHSA-wc9g-mqfw-jrwm
- https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm
- https://nvd.nist.gov/vuln/detail/CVE-2026-77078
- https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/multer/releases/tag/v2.3.0
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-84994
Qwik: Crashing any Qwik Server via Resource thenable
- MEDIUMCVE-2026-100347
kin-openapi: Unauthenticated panic (DoS) in openapi3filter legacy router via non-canonical/unsupported HTTP method on a static path
- HIGHCVE-2026-97394
kin-openapi: Nil-pointer dereference panic in openapi3filter for OpenAPI 3.1 array schemas missing items
- MEDIUMCVE-2026-107382
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
- MEDIUMCVE-2026-107392
music-metadata: uncatchable process crash parsing a crafted `.dsf` (residual of GHSA-v6c2-xwv6-8xf7)
- HIGHCVE-2026-107214
Excelize Decrypt: unrecoverable panics on malformed OLE/CFB encrypted workbooks