CVE-2026-82333

A flaw was found in Multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a specially crafted multipart request containing oversized array indices in field names. This can cause Multer's field parser to synchronously iterate a maximum-length sparse array, which blocks the event loop and prevents the application from processing other requests. This vulnerability leads to a denial of service, making the affected application unresponsive.

Multiple vulnerabilities were found in multer, a Node.js middleware for handling multipart/form-data. CVE-2026-82333 allows a remote attacker to send specially crafted multipart requests with oversized array indices in field names, causing multer's field parser to allocate and iterate maximum-length sparse arrays. This blocks the event loop and prevents the application from processing other requests, leading to a denial of service. CVE-2026-77063 allows a remote attacker to exploit a race condition between an asynchronous file filter and file size limit enforcement to bypass configured file size restrictions. While the underlying parser still truncates oversized files, this circumvents the intended rejection logic. Both vulnerabilities affect all versions of multer before 2.3.0.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs.