GHSA-wc9g-mqfw-jrwm: High severity npm/multer vulnerability
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Any application that uses multer to parse multipart/form-data requests is affected. Because exploitation is remote and unauthenticated, an attacker only needs network access to an endpoint that accepts and passes multipart requests to multer.
What does an attacker need to send to trigger the crash?
The attacker sends a single crafted multipart/form-data request containing two specially crafted text field names. This causes an uncaught RangeError during multer field parsing and terminates the Node.js process.
Does application error handling prevent the process crash?
No. The parsing error is not routed to the application's error handler, so normal application-level error handling does not prevent process termination.
What should teams do if they cannot patch immediately?
No workaround is provided. Upgrade multer to version 2.3.0 as the available remediation.