CVE-2026-77063

A flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability allows a remote attacker to bypass the intended file size restrictions, enabling the processing of files that exceed the configured limit. Although the underlying parsing mechanism still truncates the oversized file, this flaw circumvents the initial rejection of such files.

Multiple vulnerabilities were found in multer, a Node.js middleware for handling multipart/form-data. CVE-2026-82333 allows a remote attacker to send specially crafted multipart requests with oversized array indices in field names, causing multer's field parser to allocate and iterate maximum-length sparse arrays. This blocks the event loop and prevents the application from processing other requests, leading to a denial of service. CVE-2026-77063 allows a remote attacker to exploit a race condition between an asynchronous file filter and file size limit enforcement to bypass configured file size restrictions. While the underlying parser still truncates oversized files, this circumvents the intended rejection logic. Both vulnerabilities affect all versions of multer before 2.3.0.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs.