Multer
Monthly
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.
Denial of service in Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 allows remote unauthenticated attackers to exhaust server disk space when the library is configured with diskStorage. Aborted or malformed multipart uploads leave orphaned partial files because stream destruction is not propagated to the underlying fs.WriteStream, enabling resource exhaustion at scale with no public exploit identified at time of analysis. EPSS probability is low at 0.25% but SSVC marks the issue automatable with partial technical impact.
Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows unauthenticated remote attackers to exhaust CPU and memory by sending a single multipart form request with deeply nested bracket-notation field names. The flaw lives in the append-field dependency, which parses nesting depth without any cap, so one crafted POST can degrade or crash Node.js services. No public exploit identified at time of analysis, but the issue is trivially reproducible against any default multer deployment exposed on the network.
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticated attackers to crash a Node.js application by sending specially malformed multipart requests that trigger uncontrolled recursion and stack overflow. Affecting one of the most widely used file-upload middlewares in the Node.js/Express ecosystem, the flaw carries a CVSS 4.0 base score of 8.7 with availability-only impact. There is no public exploit identified at time of analysis and the EPSS score is very low (0.06%, 18th percentile), but a vendor patch and Red Hat errata are available.
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attackers exhaust server resources by submitting malformed multipart requests, crashing or hanging the upload-handling process. The flaw scores CVSS 4.0 8.7 with an availability-only impact and requires no authentication or user interaction; no public exploit has been identified at time of analysis and EPSS rates near-term exploitation probability very low (0.06%, 17th percentile). A vendor patch (2.1.0) is available and Red Hat has shipped errata, but no workaround exists.
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated attackers exhaust server resources by abruptly dropping the connection mid file-upload, leaving allocated resources unreleased. The flaw maps to CWE-772 (missing release of resource) and carries a CVSS 4.0 base score of 8.7 driven entirely by availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%), but a fixed release (2.1.0) is available and no workarounds exist.
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js server completely unresponsive using a single small multipart/form-data request. Two specially crafted field names - a large numeric array index followed by a non-numeric key - cause multer's underlying append-field dependency to synchronously iterate a maximum-length sparse array, permanently blocking the event loop and preventing the process from handling any further requests. No public exploit has been identified at time of analysis, but the attack requires no authentication and a minimal payload, making it trivially automatable against any Node.js application using unpatched multer.
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers to crash the entire Node.js process by submitting a small, specially crafted multipart/form-data request. The attack exploits an uncaught RangeError in multer's append-field dependency: a first field with an extremely large numeric index allocates a maximum-length sparse array, and a second field pushes past that limit, throwing an exception that multer does not catch. No public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity nature of the attack makes this a realistic availability threat for any internet-facing Node.js application using multer.
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass size-limit rejection when an application uses an asynchronous fileFilter in combination with the fileSize limit. All multer versions before 2.3.0 are affected. Practical impact is constrained because the underlying busboy multipart parser still truncates the stream at the configured limit, making this a logic bypass of the rejection mechanism rather than uncontrolled resource consumption or data exfiltration; the fix is available in multer 2.3.0.
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial of service by repeatedly sending aborted or malformed multipart upload requests. Each aborted request causes multer to delete the visible file entry while leaving the underlying write file descriptor open, retaining disk blocks until process exit. With no public exploit identified at time of analysis and no CISA KEV listing, this is nonetheless trivially automatable - any publicly exposed upload route using DiskStorage is a viable target.
Denial of service in Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 allows remote unauthenticated attackers to exhaust server disk space when the library is configured with diskStorage. Aborted or malformed multipart uploads leave orphaned partial files because stream destruction is not propagated to the underlying fs.WriteStream, enabling resource exhaustion at scale with no public exploit identified at time of analysis. EPSS probability is low at 0.25% but SSVC marks the issue automatable with partial technical impact.
Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows unauthenticated remote attackers to exhaust CPU and memory by sending a single multipart form request with deeply nested bracket-notation field names. The flaw lives in the append-field dependency, which parses nesting depth without any cap, so one crafted POST can degrade or crash Node.js services. No public exploit identified at time of analysis, but the issue is trivially reproducible against any default multer deployment exposed on the network.
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticated attackers to crash a Node.js application by sending specially malformed multipart requests that trigger uncontrolled recursion and stack overflow. Affecting one of the most widely used file-upload middlewares in the Node.js/Express ecosystem, the flaw carries a CVSS 4.0 base score of 8.7 with availability-only impact. There is no public exploit identified at time of analysis and the EPSS score is very low (0.06%, 18th percentile), but a vendor patch and Red Hat errata are available.
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attackers exhaust server resources by submitting malformed multipart requests, crashing or hanging the upload-handling process. The flaw scores CVSS 4.0 8.7 with an availability-only impact and requires no authentication or user interaction; no public exploit has been identified at time of analysis and EPSS rates near-term exploitation probability very low (0.06%, 17th percentile). A vendor patch (2.1.0) is available and Red Hat has shipped errata, but no workaround exists.
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated attackers exhaust server resources by abruptly dropping the connection mid file-upload, leaving allocated resources unreleased. The flaw maps to CWE-772 (missing release of resource) and carries a CVSS 4.0 base score of 8.7 driven entirely by availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%), but a fixed release (2.1.0) is available and no workarounds exist.