CVE-2026-82333

highpriority · track · 0EPSS 0.005 · 41 %ileDEFRUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.49% (41st) EPSS
CVSS 7.5 · high
Is it mine?
7 products
Check your exposure
Who says so?
4 sources
cert_bund · nvd · osv · certfr

EPSS · scored 2026-10-23

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.

01

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondaryexploitability 3.9 · impact 3.6
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-400USCWE-400US
03

affected products (7)

Products and version ranges known to be affected.

04

advisories (3)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2026-3596IBM App Connect Enterprise: Mehrere SchwachstellenDeutsch2026-09-27csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren und um einen Cross-Site Scripting Angriff durchzuführen.

  • GHSA-535w-7cp7-47q4multer vulnerable to Denial of Service via oversized array index in field names2026-09-08ghsa · osvUS

    ### Impact multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x. ### Patches Users should upgrade to `2.3.0` and configure `limits.fieldArrayIndexLimit` to the minimum array index their application requires. ### Workarounds None.

  • CERTFR-2026-AVI-1378Multiples vulnérabilités dans les produits IBMFrançais2026-10-23vendor · certfrFR
05

sources

Which sources assert this record, and when.

cert_bundnvdosvcertfrNVDCVE.orgMITRE
published 2026-08-28modified 2026-09-02
06

references (2) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan