CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names

Executive brief

Multer, a popular middleware for handling file uploads in web applications, is vulnerable to a Denial of Service (DoS) attack. An attacker can send a specially crafted request with deeply nested field names to exhaust the server's CPU and memory resources. This can lead to application crashes or significant performance degradation, preventing legitimate users from accessing the service.

Technical details

Multer is vulnerable to Uncontrolled Resource Consumption (CWE-400) due to how its dependency, `append-field`, handles bracket notation in multipart form field names (e.g., `a[b][c]`). The parser does not enforce a limit on nesting depth, allowing a remote, unauthenticated attacker to submit a single HTTP request that forces the server to allocate deeply nested object structures. This process consumes excessive CPU and memory, leading to a Denial of Service. The issue is resolved in version 2.2.0, which introduces the `limits.fieldNestingDepth` configuration option.

Affected products

• expressjs multer >= 1.0.0, < 2.2.0; >= 3.0.0-alpha.1, < 3.0.0-alpha.2

Timeline

• 2026-06-15: disclosed
• 2026-06-17: advisory
• 2026-06-17: patched: Fixed in version 2.2.0 and 3.0.0-alpha.2

References

• https://api.github.com/users/tndud042713
• https://github.com/tndud042713
• https://api.github.com/users/tndud042713/gists%7B/gist_id%7D
• https://api.github.com/users/tndud042713/repos
• https://avatars.githubusercontent.com/u/70098543?v=4
• https://api.github.com/users/tndud042713/events%7B/privacy%7D