CVE-2026-5079

A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system.

This is an Important denial of service vulnerability in Multer, a Node.js middleware for handling multipart/form-data. An attacker can exploit this flaw by sending a crafted HTTP request with deeply nested field names, leading to excessive resource consumption and service unavailability. This is particularly relevant for Red Hat products that expose Multer-based services to untrusted network input.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce the impact of this denial of service vulnerability, configure the limits.fields option within your multer instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability.