Executive brief
multer is a Node.js middleware library used to handle file uploads in web applications. An attacker can craft a malicious HTTP request with oversized array indices in multipart field names to force the server to allocate massive amounts of memory and consume CPU synchronously, rendering the application unable to process legitimate requests. A single request is sufficient to trigger this denial of service.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in multer's handling of multipart form data. The append-field dependency parses bracket notation in field names, and when a large numeric array index like items[4294967294] is supplied, it triggers allocation of a maximum-length sparse array. When a subsequent field with a non-numeric key is processed on the same base field, the array is converted to an object by iterating its full length, consuming CPU synchronously. This blocks event loop processing and prevents the application from handling other incoming requests. The attack requires only network access with no authentication or user interaction. Patch is available in version 2.3.0, which includes a new limits.fieldArrayIndexLimit configuration option to restrict array indices.
Affected products
- expressjs multer < 2.3.0
Timeline
- 2026-08-28: disclosed: Published to National Vulnerability Database
- 2026-09-08: advisory: GitHub Advisory Database published
- 2026-09-08: patched: Version 2.3.0 released with fix