CVE-2026-82333: multer vulnerable to Denial of Service via oversized array index in field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Set the multer option limits.fieldArrayIndexLimit to the largest array index your application needs. This enables mitigation by rejecting oversized array indexes (multer 2.3.0 introduces the opt-in fieldArrayIndexLimit option).
multer limits.fieldArrayIndexLimit = the largest array index your application needs
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote client able to send multipart/form-data requests to an application using an affected multer version can trigger the denial of service. No authentication or user interaction is required.
Are default deployments affected?
Affected versions before 2.3.0 are vulnerable when they process attacker-controlled multipart form fields. The issue is triggered by two specially crafted text field names, including one with a large numeric array index.
What configuration change remediates the issue after upgrading?
Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index required by the application. This option rejects oversized array indexes.
What is the operational impact of a successful attack?
The crafted request causes synchronous iteration of a maximum-length sparse array, blocking the Node.js event loop. While blocked, the process cannot handle other requests.