CVE-2026-77078: Multer Denial of Service via Crafted Multipart Field Names
Summary
CVE-2026-77078: multer vulnerable to Denial of Service via crafted multipart field names. Affects multer versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Multer is a middleware for handling multipart/form-data, primarily used for uploading files in Node.js applications. It simplifies the process of parsing incoming request bodies, allowing developers to easily manage file uploads and form submissions. However, due to its reliance on field name parsing, Multer is vulnerable to specific crafted inputs that can lead to severe issues, including application crashes.
Vulnerability Detail
A vulnerability in Multer allows a remote, unauthenticated attacker to crash the Node.js process by sending a single multipart/form-data request with specially crafted text field names. This results in an uncaught RangeError: Invalid array length during the field parsing process, which is not handled by the application error handler, leading to a termination of the Node.js process. All applications using Multer to parse multipart requests are at risk.
How To Fix
Latest published version: 2.5.0 as of 23 Oct 2026
npm install multer@2.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
npm install multer@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no known workarounds for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
Multer's vulnerability (CVE-2026-77078) poses a significant risk to applications that rely on it for handling multipart/form-data requests. By upgrading to version 2.3.0 or later, developers can mitigate this risk and ensure their applications remain stable and secure.
See every vulnerability recorded for multer →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If left unaddressed, this vulnerability can allow attackers to crash your Node.js application, leading to service disruptions and potential data loss.
Yes, the vulnerability affects all versions of Multer prior to 2.3.0. Upgrading to this version or later is essential for protection.
Yes, after updating to version 2.3.0 or later, Multer should be safe to use without the risk of this specific Denial of Service vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for multer.
