CVE-2026-82333: multer vulnerable to Denial of Service via oversized array index in field names
Impact
multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items[4294967294] forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.
Patches
Users should upgrade to 2.3.0 and configure limits.fieldArrayIndexLimit to the minimum array index their application requires.
Workarounds
None.
Other sources
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Configure multer's opt-in limits.fieldArrayIndexLimit to a value that rejects oversized array indexes (e.g., set it to the maximum/minimum array index required by your application) after upgrading to 2.3.0.
multer limits.fieldArrayIndexLimit = Set to the largest array index your application needs (or the minimum array index your application requires).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any remote client able to send multipart/form-data requests to an application using an affected multer version can trigger the denial of service. No authentication or user interaction is required.
Are default deployments affected?
Affected versions before 2.3.0 are vulnerable when they process attacker-controlled multipart form fields. The issue is triggered by two specially crafted text field names, including one with a large numeric array index.
What configuration change remediates the issue after upgrading?
Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index required by the application. This option rejects oversized array indexes.
What is the operational impact of a successful attack?
The crafted request causes synchronous iteration of a maximum-length sparse array, blocking the Node.js event loop. While blocked, the process cannot handle other requests.