Multer is affected by three vulnerabilities in versions prior to 2.3.0, including two high-severity denial-of-service vulnerabilities and a low-severity file size limit bypass. The issues can allow unauthenticated attackers to exhaust server resources through crafted multipart uploads or bypass configured upload restrictions under specific configurations.
* CVE-2026-82333 (CVSS 7.5 – High): A denial-of-service vulnerability caused by oversized numeric array indexes in multipart field names. A crafted field such as `items[4294967294]` can force allocation of a maximum-length sparse array, followed by CPU-intensive processing that can block the application from handling other requests. A single crafted HTTP request is sufficient to trigger the issue.[/subscribe_to_unlock_form]
Multer is affected by three vulnerabilities in versions prior to 2.3.0, including two high-severity denial-of-service vulnerabilities and a low-severity file size limit bypass. The issues can allow unauthenticated attackers to exhaust server resources through crafted multipart uploads or bypass configured upload restrictions under specific configurations.
* CVE-2026-82333 (CVSS 7.5 – High): A denial-of-service vulnerability caused by oversized numeric array indexes in multipart field names. A crafted field such as `items[4294967294]` can force allocation of a maximum-length sparse array, followed by CPU-intensive processing that can block the application from handling other requests. A single crafted HTTP request is sufficient to trigger the issue.[emaillocker id="1283"]
* CVE-2026-77063 (CVSS 3.7 – Low): A file size limit bypass caused by a race condition when Multer uses an asynchronous `fileFilter`. If an uploaded file exceeds the configured `limits.fileSize` before the asynchronous callback registers the `'limit'` event, the event can be missed and the oversized file may be accepted. Applications using a synchronous `fileFilter` are not affected.
* CVE-2026-77037 (CVSS 7.5 – High): A denial-of-service vulnerability in Multer 2.2.0 when using `diskStorage`. An attacker can abort or truncate multipart uploads before completion, causing the destination write stream to remain open and leak file descriptors and disk blocks. Repeated failed uploads can exhaust available file descriptors and disrupt the application.
We recommend you to update multer to version 2.3.0.
The following reports contain further technical details:
[/emaillocker]