CVE-2026-77078

Summary

multer vulnerable to Denial of Service via crafted multipart field names

Severity

high

CVSS

7.5

EPSS

0.3% (p21)

CWE

CWE-248

Also known as

GHSA-wc9g-mqfw-jrwm

Published

2026-09-08

Updated

2026-09-08

Advisory details

Impact

A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.

Patches

Users should upgrade to 2.3.0.

Workarounds

None.

References

• https://github.com/advisories/GHSA-wc9g-mqfw-jrwm
• https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm
• https://nvd.nist.gov/vuln/detail/CVE-2026-77078
• https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76
• https://cna.openjsf.org/security-advisories.html
• https://github.com/expressjs/multer/releases/tag/v2.3.0

Related advisories

• CVE-2026-77037 — high · npm/multer
• CVE-2026-82333 — high · npm/multer
• CVE-2026-5079 — high · npm/multer
• CVE-2026-5038 — medium · npm/multer
• CVE-2026-84445 — high · Go/google.golang.org/grpc
• CVE-2026-73088 — high · npm/browserslist
• CVE-2026-55484 — high · Go/github.com/guno1928/alos-http
• GHSA-pfvm-w89x-94jw — high · NuGet/SIPSorcery

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity