multer CVE-2026-5079

The target application must use multer 1.0.0-2.1.1 or 3.0.0-alpha.1 as multipart middleware on a network-reachable HTTP endpoint that accepts multipart/form-data; no authentication, user interaction, or special configuration is required because nested bracket parsing in append-field is enabled by default. Limiting factors are minimal: any route registered with multer().any(), .fields(), .array() or .single() that processes the request body will parse field names, so the only meaningful gating is whether the upload route is exposed externally or sits behind authentication, and even authenticated low-privilege users can trigger it.

CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H aligns with the description: a single network request with no authentication, no user interaction, and low complexity yields a high availability impact. No EPSS score, KEV listing, or public POC was provided, so this currently appears to be a disclosure-stage issue rather than active exploitation; however, the trigger is so simple (a crafted field name) that POC development is trivial once the advisory is studied. Real-world priority is high for any internet-facing Node.js service that accepts multipart uploads - auth-gated admin endpoints reduce exposure but do not eliminate it because authenticated low-privilege users can still trigger the DoS.

An attacker identifies an internet-facing endpoint (login, contact form, file upload, profile edit) that accepts multipart/form-data and is handled by multer. They send a single HTTP POST whose multipart body contains a field name like a[a][a]...[a] repeated thousands of times; multer hands this to append-field, which allocates a correspondingly deep object tree, spiking CPU and RSS until the Node.js worker becomes unresponsive or the process is OOM-killed, taking the service offline.