multer vulnerable to Denial of Service via oversized array index in field names
### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x. ### Patches Users should upgrade to `2.3.0` and configure `limits.fieldArrayIndexLimit` to the minimum array index their application requires. ### Workarounds None.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-82333US | — | — | ||
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronous… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://cna.openjsf.org/security-advisories.htmlWEB
- https://github.com/expressjs/multerPACKAGE
- https://github.com/expressjs/multer/commit/73c1759fa93b87366bc6dbd7abe1b80ddff7d27cWEB
- https://github.com/expressjs/multer/pull/1438WEB
- https://github.com/expressjs/multer/releases/tag/v2.3.0WEB
- https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-82333ADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan