multer vulnerable to Denial of Service via oversized array index in field names

CAO 7.5CVE-2026-82333 · GHSA-535w-7cp7-47q4 · Công bố 28/08/2026 · cập nhật 02/09/2026

Tóm tắt nhanh

CVE-2026-82333 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng multer (expressjs), multer.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.37%, cao hơn 30.6% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.3.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
multer expressjs	`< 2.3.0`	`2.3.0`
multer npm	`< 2.3.0`	`2.3.0`

Mô tả

Impact

multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items[4294967294] forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.

Patches

Users should upgrade to 2.3.0 and configure limits.fieldArrayIndexLimit to the minimum array index their application requires.

Workarounds

None.

Mô tả của NVD

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.