CVE-2026-77078: multer vulnerable to Denial of Service via crafted multipart field names
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Other sources
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Applications using multer versions before 2.3.0 are affected when they process multipart/form-data requests. Because the attack is remotely triggerable and requires no privileges or user interaction, any reachable multipart upload endpoint using an affected version is potentially exposed.
What does an attacker need to send to trigger the failure?
An attacker can send a small multipart request containing two specially crafted text field names. The first uses a very large numeric array index and the second causes a push beyond the resulting maximum-length sparse array, leading to an uncaught RangeError that terminates the Node.js process.
How can I remediate the issue?
Upgrade multer to version 2.3.0. The vulnerability affects all versions earlier than 2.3.0.