Executive brief
Multer is a popular Node.js middleware library used to handle file uploads in web applications. A vulnerability in versions before 2.1.1 allows attackers to crash or disable web servers by sending specially crafted upload requests that trigger excessive recursion in the library's parsing logic. This can lead to service outages affecting all users relying on the vulnerable application.
Technical details
The vulnerability is a classic uncontrolled recursion flaw (CWE-674) in Multer's multipart form data parsing logic. When processing malformed multipart/form-data requests, the library fails to properly bound recursive function calls, leading to stack exhaustion. The attack requires no authentication or user interaction and is remotely exploitable via network requests containing crafted multipart field names or nested structures. A successful exploit causes a denial of service by exhausting the application's call stack, triggering a process crash. The fix was released in version 2.1.1 and is available via a simple package upgrade.
Affected products
- Express.js Foundation Multer <2.1.1
Timeline
- 2026-03-05: disclosed: GHSA-5528-5vmv-3xc2 published
- 2026-03-04: advisory: CVE-2026-3520 assigned
- 2026-03-05: patched: Version 2.1.1 released with fix