CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names
Attackers can crash Node.js applications by sending crafted multipart requests with specific field names, requiring an upgrade to the multer library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77078?
CVE-2026-77078 is a high-severity denial of service vulnerability in multer, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Weakness: CWE-248
Which versions are affected by CVE-2026-77078?
2 open source packages ship an affected version, including multer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
multer npm | All versions | 2.3.0 |
multer npm | All versions | 2.3.0 |
Products include Expressjs Multer.
How do I fix CVE-2026-77078?
Upgrade multer to 2.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77078 being exploited?
There is no known exploitation of CVE-2026-77078 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in multer
- CVE-2026-3520 Multer vulnerable to Denial of Service via uncontrolled recursion
- CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion
- CVE-2026-3304 Multer vulnerable to Denial of Service via incomplete cleanup
- CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
- CVE-2026-82333 multer vulnerable to Denial of Service via oversized array index in field names
Sources
Also known as CLEANSTART-2026-SY10703, ECHO-fc2c-5e78-0dc2, GHSA-wc9g-mqfw-jrwm, MINI-7mrp-j9g3-2cfm, MINI-9w7f-8f94-rjr5, MINI-pfgx-j48p-fmwh and 1 more.