Which versions of Multer are affected by CVE-2026-3520?

Multer, a widely deployed file-upload middleware for Express.js applications, contains a remote denial-of-service vulnerability (CVE-2026-3520) that allows unauthenticated attackers to crash affected…. A patch is available.

How to fix or mitigate CVE-2026-3520?

Within 24 hours: Identify all Node.js/Express applications in production that depend on Multer via dependency scanning tools or package manifests. Within 7 days: Deploy Multer 2.1.1 or later across all affected systems, beginning with non-critical environments and staging. Within 30 days: Complete production rollout and validate application stability across all updated deployments.

Multer CVE-2026-3520

Q: What is the CVSS score of CVE-2026-3520?

CVE-2026-3520 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Uncontrolled Recursion (CWE-674)

2026-03-04 ce714d77-add3-4f53-aff5-83d477b104bb

GHSA-5528-5vmv-3xc2

Node.js Denial Of Service Multer

8.7

CVSS 4.0 · Vendor: ce714d77-add3-4f53-aff5-83d477b104bb

Severity by source

Vendor (ce714d77-add3-4f53-aff5-83d477b104bb) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, no-auth, low-complexity malformed request reaches the upload endpoint (AV:N/AC:L/PR:N/UI:N); impact is a process crash only, so C:N/I:N/A:H with unchanged scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).

CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:06 vuln.today

v5 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:04 vuln.today

v4 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:03 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:03 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

7.5 (HIGH) 8.7 (HIGH)

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

Patch released

Mar 09, 2026 - 18:03 nvd

Patch available

CVE Published

Mar 04, 2026 - 17:16 nvd

HIGH 7.5

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

117 npm packages depend on multer (44 direct, 75 indirect)

Ecosystem-wide dependent count for version 2.1.1.

DescriptionCVE.org

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.

AnalysisAI

Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticated attackers to crash a Node.js application by sending specially malformed multipart requests that trigger uncontrolled recursion and stack overflow. Affecting one of the most widely used file-upload middlewares in the Node.js/Express ecosystem, the flaw carries a CVSS 4.0 base score of 8.7 with availability-only impact. There is no public exploit identified at time of analysis and the EPSS score is very low (0.06%, 18th percentile), but a vendor patch and Red Hat errata are available.

Technical ContextAI

Multer is Express.js middleware that parses incoming multipart/form-data request bodies, primarily for handling file uploads. The vulnerability is classified as CWE-674 (Uncontrolled Recursion): malformed multipart input drives the parser into excessively deep or unbounded recursive processing, exhausting the call stack and producing a stack overflow that terminates the Node.js process. Because Node.js runs application logic in a single main event-loop thread, an unhandled crash of this kind takes down the entire service rather than an isolated worker. The affected component is identified by CPE cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:*, covering all releases prior to 2.1.1.

RemediationAI

Upgrade Multer to version 2.1.1 or later, which contains the patch (upstream fix commit 7e66481f8b2e6c54b982b34c152479e096ce2752, vendor advisory GHSA-5528-5vmv-3xc2). Vendor-released patch: 2.1.1. The vendor states no known workarounds are available, so patching is the only complete remediation. Red Hat users should apply the corresponding distribution errata RHSA-2026:6174 or RHSA-2026:6802. Until the upgrade can be deployed, the only meaningful compensating controls are infrastructure-level: place a reverse proxy or WAF in front of upload endpoints to enforce strict limits on multipart body size and part count, and restrict or rate-limit access to file-upload routes to reduce the crash surface - with the trade-off that legitimate large or complex uploads may be rejected and these controls do not address the underlying recursion flaw. Process supervisors (PM2, systemd, container restart policies) should be in place to auto-restart crashed Node.js workers, though this only limits downtime rather than preventing the DoS.