multer EUVD-2026-67932

No special configuration or non-default deployment mode is required beyond the target application running an unpatched version of multer (any version before 2.3.0) with at least one HTTP endpoint where multer middleware is active. The attack does not require file upload - two plain text fields in a multipart request suffice. Unauthenticated access to the multer-protected route is the sole prerequisite per the CVSS vector (PR:N). Exploitation is limited by: network reachability to the target service, and the presence of at least one multer-handled route. Applications that apply multer exclusively behind authentication middleware have a reduced but not eliminated attack surface (authenticated attackers, including low-privilege users, can still trigger the DoS). Applications that do not accept multipart/form-data at all are not affected.

The CVSS 7.5 score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H are well-calibrated to this vulnerability - network-accessible, low complexity, no privileges or user interaction required, and high availability impact. This is not a case of inflated CVSS with low real-world risk: the attack is trivially executable via a single small HTTP POST, guaranteed to block the event loop upon success, and requires zero authentication. EPSS score is not provided in the available intelligence. The vulnerability is not currently listed in CISA KEV, and no public exploit code has been identified at time of analysis - however, the attack mechanism is simple enough that exploit code would require minimal effort to develop independently from the advisory description. The primary risk amplifier is multer's pervasive use across the Node.js Express ecosystem: any application with an unprotected multer route is a viable target. SSVC signals indicate the vulnerability is automatable (single crafted request), technically impactful (full process DoS), but not yet confirmed exploited in the wild - placing remediation priority in the high tier for internet-exposed services.

An unauthenticated attacker sends a single small multipart/form-data HTTP POST request to any endpoint where multer middleware is active, with a first text field named using a very large numeric array index such as field[999999999] and a second text field using a non-numeric key. Upon receipt, multer's append-field dependency synchronously iterates the full sparse array allocated by the first field, blocking the Node.js event loop indefinitely and causing the server to stop responding to all subsequent requests. No public exploit code has been identified, but the mechanism is directly reproducible from the advisory description without additional reverse engineering.