CVE-2026-77078: multer vulnerable to Denial of Service via crafted multipart field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using multer versions before 2.3.0 are affected when they process multipart/form-data requests. Because the attack is remotely triggerable and requires no privileges or user interaction, any reachable multipart upload endpoint using an affected version is potentially exposed.
What does an attacker need to send to trigger the failure?
An attacker can send a small multipart request containing two specially crafted text field names. The first uses a very large numeric array index and the second causes a push beyond the resulting maximum-length sparse array, leading to an uncaught RangeError that terminates the Node.js process.
How can I remediate the issue?
Upgrade multer to version 2.3.0. The vulnerability affects all versions earlier than 2.3.0.