CVE-2026-82333
highPriorität · verfolgen · 0EPSS 0.005 · 41. PerzentilDEFRUSEPSS · bewertet 2026-10-23
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.9–7.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (7)
Betroffene Produkte und Versionsbereiche.
- IBM WebSphere Service Registry and Repositoryalle Versionencert_bundDEcpe:/a:ibm:websphere_service_registry_and_repository:-
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- WID-SEC-W-2026-3596IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-09-27csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.
- GHSA-535w-7cp7-47q4multer vulnerable to Denial of Service via oversized array index in field names2026-09-08ghsa · osvUS
### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x. ### Patches Users should upgrade to `2.3.0` and configure `limits.fieldArrayIndexLimit` to the minimum array index their application requires. ### Workarounds None.
- CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (2) nvd
Externe Belege — Patches, Meldungen, Analysen.
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan