Denial of Service Vulnerability in multer by Express.js

CVE-2026-5079

What is CVE-2026-5079?

The multer library, used for handling multipart form data in Node.js applications, is susceptible to a Denial of Service vulnerability. Attackers can exploit this by sending a malicious multipart body that contains deeply nested field names, leading to excessive CPU and memory usage. This occurs due to the append-field dependency's lack of limits on the depth of nesting, allowing extensive object structures to be allocated. To mitigate this issue, users should upgrade to multer version 2.2.0 or 3.0.0-alpha.2 and implement the new limits.fieldNestingDepth configuration to control nesting depth. Additionally, setting limits.fields can help restrict the number of fields processed per request.

References