EUVD-2026-36726
GHSA-72gw-mp4g-v24j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Single unauthenticated network request against default multer config (AV:N/AC:L/PR:N/UI:N) yields availability-only impact via resource exhaustion; no confidentiality or integrity effect.
Primary rating from Vendor (openjs).
CVSS VectorVendor: openjs
Lifecycle Timeline
2Blast Radius
ecosystem impact- 114 npm packages depend on multer (61 direct, 53 indirect)
Ecosystem-wide dependent count for version 1.0.0.
DescriptionCVE.org
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
AnalysisAI
Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows unauthenticated remote attackers to exhaust CPU and memory by sending a single multipart form request with deeply nested bracket-notation field names. The flaw lives in the append-field dependency, which parses nesting depth without any cap, so one crafted POST can degrade or crash Node.js services. No public exploit identified at time of analysis, but the issue is trivially reproducible against any default multer deployment exposed on the network.
Technical ContextAI
multer is the de-facto Express/Connect middleware for handling multipart/form-data uploads in Node.js. To support HTML-style nested form inputs (e.g. user[address][street]), multer delegates field-name parsing to the append-field library, which recursively expands bracket notation into nested JavaScript objects. Because append-field imposed no maximum nesting depth, an attacker-controlled field name such as a[a][a][a]...[a] forces the parser to allocate an arbitrarily deep object graph, consuming heap memory and event-loop time. This is a classic CWE-400 Uncontrolled Resource Consumption pattern, similar to algorithmic complexity and prototype-tree blowups seen historically in qs and body-parser.
RemediationAI
Vendor-released patch: multer 2.2.0 on the 2.x line and 3.0.0-alpha.2 on the 3.x prerelease line; upgrade and then explicitly configure the new limits.fieldNestingDepth option to the minimum depth your application actually needs (most apps need 1-2). If an immediate upgrade is not possible, set limits.fields to a small value to cap the number of fields per request - this reduces but does not eliminate the DoS, since a single deeply nested name still triggers excessive allocation. Additional compensating controls include placing a reverse proxy or WAF rule in front of upload endpoints to reject multipart bodies containing field names with more than a handful of [ characters, and enforcing request size limits via limits.fileSize/fields; the trade-off is that legitimate nested forms (e.g. complex admin UIs) may be rejected. Track the GHSA-72gw-mp4g-v24j advisory for any backports.
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticat
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attack
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers t
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js
Denial of service in Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 allows remote unauthenticated attacke
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today