CVE-2026-77078
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- EPSS probability
- 0.29%
- CWE
- CWE-248
- Published
- 2026-08-28
- Last modified
- 2026-08-31
Affected products
- multer multer
- multer multer
Weakness type
Related vulnerabilities
- CVE-2026-69839 — Windows iSCSI Target Service Denial of Service Vulnerability
- CVE-2026-82058 — Unhandled Exception in MongoDB Server JSON Schema Validation Error Generation Leads to Denial of Service
- CVE-2022-51014 — PocketMine-MP before 4.0.7 Denial of Service via JSON Decoding
- CVE-2022-51009 — PocketMine-MP before 4.7.2 Denial of Service via Skin Geometry
- CVE-2026-19534 — undici vulnerable to Denial of Service via unrequested WebSocket subprotocol
- CVE-2026-84947 — undici vulnerable to response truncation via oversized chunked responses in the dump interceptor
- CVE-2026-85014 — undici vulnerable to Denial of Service via WebSocketStream unclean close
- CVE-2026-85024 — undici vulnerable to Denial of Service via unhandled error in WebSocket permessage-deflate decompression