Multer CVE-2026-3520

Exploitation requires that the target application uses Multer (prior to 2.1.1) to process multipart/form-data and exposes a route that invokes Multer's parsing - i.e., any reachable file-upload or multipart form endpoint. The attacker sends malformed multipart request bodies that trigger the recursive parsing path; no authentication, credentials, or user interaction are needed (PR:N/UI:N), and the attack is over the network (AV:N) with low complexity (AC:L). The principal limiting factor is reachability: the application must actually wire Multer into an accessible endpoint, and any upstream proxy/WAF that strictly validates or caps multipart structure and size before it reaches Node.js can blunt the attack. Impact is limited to availability - the process crashes - with no data exposure or modification.

The signals are mixed but coherent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates the flaw is remotely reachable, low-complexity, and requires no authentication or user interaction - easy to trigger against any exposed upload endpoint. However, impact is strictly availability (VC:N/VI:N/VA:H): no data disclosure or integrity loss, only a crash. The score of 8.7 (high) reflects that easy-to-reach availability impact. Counterbalancing this, the EPSS probability is very low (0.06%, 18th percentile), the CVE is NOT in CISA KEV, and no public exploit has been identified, so there is no evidence of active or imminent widespread exploitation. Net assessment: this is a genuine, easy-to-trigger availability risk for internet-facing Express applications that accept file uploads, and should be patched promptly, but it is not a confidentiality/integrity breach and current real-world exploitation pressure appears low. No conflicting signals were detected between the vector and description - both consistently describe a remote, no-auth DoS.

An attacker identifies an internet-facing Express.js application that uses Multer to accept file or form uploads, then sends a specially crafted malformed multipart/form-data request to the upload endpoint. The deeply nested or malformed structure drives Multer into uncontrolled recursion, causing a stack overflow that crashes the Node.js process and takes the service offline; repeated requests sustain the outage. No public exploit code has been identified, and given AV:N/AC:L/PR:N/UI:N the request can be sent remotely with no authentication and minimal effort.