Is CVE-2026-3520 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3520 being exploited in the wild.

How severe is CVE-2026-3520?

High severity, with a CVSS score of 7.5, published 4 March 2026.

Which products and versions are affected?

multer (npm) SEMVER:introduced=0,fixed=2.1.1.

Is there a fix for CVE-2026-3520?

Yes. multer (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3520 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3520?

Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3520: expressjs Multer denial of service via uncontrolled recursion

CVE-2026-3520 · Severity: high · CVSS 7.5 · Published 2026-03-04

Multer is a popular Node.js middleware library used to handle file uploads in web applications. A vulnerability in versions before 2.1.1 allows attackers to crash or disable web servers by sending specially crafted upload requests that trigger excessive recursion in the library's parsing logic. This can lead to service outages affecting all users relying on the vulnerable application.

Technologies: multer (npm). Vendors: npm.

Quick answers

Is CVE-2026-3520 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3520 being exploited in the wild.
How severe is CVE-2026-3520?: High severity, with a CVSS score of 7.5, published 4 March 2026.
Which products and versions are affected?: multer (npm) SEMVER:introduced=0,fixed=2.1.1.
Is there a fix for CVE-2026-3520?: Yes. multer (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3520 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3520?: Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.1.1 or later
```
npm install multer@2.1.1
```

Technical details

The vulnerability is a classic uncontrolled recursion flaw (CWE-674) in Multer's multipart form data parsing logic. When processing malformed multipart/form-data requests, the library fails to properly bound recursive function calls, leading to stack exhaustion. The attack requires no authentication or user interaction and is remotely exploitable via network requests containing crafted multipart field names or nested structures. A successful exploit causes a denial of service by exhausting the application's call stack, triggering a process crash. The fix was released in version 2.1.1 and is available via a simple package upgrade.

Affected products

Express.js Foundation Multer <2.1.1

Identifiers

CVE-2026-3520
GHSA-5528-5vmv-3xc2

Timeline

2026-03-05: disclosed: GHSA-5528-5vmv-3xc2 published
2026-03-04: advisory: CVE-2026-3520 assigned
2026-03-05: patched: Version 2.1.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.