Denial of Service Vulnerability in Multer Middleware for Node.js

CVE-2026-82333

What is CVE-2026-82333?

A vulnerability exists in Multer, a middleware for Node.js that processes multipart/form-data. This flaw arises when a small multipart request uses two specially crafted text field names, causing Multer's field parser to iterate through a maximum-length sparse array. This operation can block the event loop, preventing the Node.js process from managing other requests. Specifically, a large numeric index in one field allocates a sparse array, while the second field, containing a non-numeric key, prompts a complete iteration in the append-field dependency. All versions prior to 2.3.0 are impacted. The release of Multer 2.3.0 introduces an opt-in fieldArrayIndexLimit option that mitigates this issue by rejecting oversized array indexes, thus enhancing the performance and security of applications relying on this middleware.

References