~ / search / GHSA-wc9g-mqfw-jrwm

GHSA-wc9g-mqfw-jrwm

multer vulnerable to Denial of Service via crafted multipart field names

Source: GitHub Advisory Database (reviewed) High CVE-2026-77078

Packages

EcosystemPackageAffectedFixed in
npm multer < 2.3.0 2.3.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected. ### Patches Users should upgrade to `2.3.0`. ### Workarounds None.

References

External links from the advisory. They lead to third-party sites.