Summary
multer vulnerable to Denial of Service via oversized array index in field names
Advisory details
Impact
multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items[4294967294] forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.
Patches
Users should upgrade to 2.3.0 and configure limits.fieldArrayIndexLimit to the minimum array index their application requires.
Workarounds
None.
References
- https://github.com/advisories/GHSA-535w-7cp7-47q4
- https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4
- https://nvd.nist.gov/vuln/detail/CVE-2026-82333
- https://github.com/expressjs/multer/pull/1438
- https://github.com/expressjs/multer/commit/73c1759fa93b87366bc6dbd7abe1b80ddff7d27c
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/multer/releases/tag/v2.3.0
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- MEDIUMCVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- MEDIUMCVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- MEDIUMCVE-2026-104150
AdonisJS HTTP Server: Uncontrolled Resource Consumption and Inefficient Regular Expression Complexity
- HIGHCVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion
- HIGHCVE-2026-107805
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage