Is CVE-2026-82333 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82333 being exploited in the wild.

How severe is CVE-2026-82333?

High severity, with a CVSS score of 7.5, published 28 August 2026.

Which products and versions are affected?

multer (npm) SEMVER:introduced=0,fixed=2.3.0.

Is there a fix for CVE-2026-82333?

Yes. multer (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82333 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82333?

Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82333: multer denial of service via oversized array index

CVE-2026-82333 · Severity: high · CVSS 7.5 · Published 2026-08-28

multer is a Node.js middleware library used to handle file uploads in web applications. An attacker can craft a malicious HTTP request with oversized array indices in multipart field names to force the server to allocate massive amounts of memory and consume CPU synchronously, rendering the application unable to process legitimate requests. A single request is sufficient to trigger this denial of service.

Technologies: multer (npm). Vendors: npm.

Quick answers

Is CVE-2026-82333 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82333 being exploited in the wild.
How severe is CVE-2026-82333?: High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?: multer (npm) SEMVER:introduced=0,fixed=2.3.0.
Is there a fix for CVE-2026-82333?: Yes. multer (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82333 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82333?: Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.3.0 or later
```
npm install multer@2.3.0
```

Technical details

The vulnerability is an uncontrolled resource consumption issue (CWE-400) in multer's handling of multipart form data. The append-field dependency parses bracket notation in field names, and when a large numeric array index like items[4294967294] is supplied, it triggers allocation of a maximum-length sparse array. When a subsequent field with a non-numeric key is processed on the same base field, the array is converted to an object by iterating its full length, consuming CPU synchronously. This blocks event loop processing and prevents the application from handling other incoming requests. The attack requires only network access with no authentication or user interaction. Patch is available in version 2.3.0, which includes a new limits.fieldArrayIndexLimit configuration option to restrict array indices.

Affected products

expressjs multer < 2.3.0

Identifiers

CVE-2026-82333
GHSA-535w-7cp7-47q4

Timeline

2026-08-28: disclosed: Published to National Vulnerability Database
2026-09-08: advisory: GitHub Advisory Database published
2026-09-08: patched: Version 2.3.0 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.