Description

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-28T22:16:53.883Z",
  "pubdate": "2026-08-28T22:16:53.883Z",
  "executiveSummary": "The Node.js middleware 'multer' is susceptible to a remotely triggerable Denial of Service (DoS) vulnerability due to improper exception handling when processing multipart/form-data requests.\nThe vulnerability arises from the injection of specially crafted text field names that trigger an uncaught RangeError, specifically an 'Invalid array length' exception.\nBy manipulating field name indices to allocate a maximum-length sparse array and subsequently forcing an append operation beyond this capacity, an attacker can crash the Node.js process.\nThis vulnerability affects all versions of 'multer' prior to 2.3.0.\nThe risk is significant as it requires no authentication or high-level privileges to execute, allowing an unauthenticated remote attacker to cause a complete service termination through a small, malicious multipart request.\nOrganizations relying on 'multer' for file or data ingestion are at risk of service availability disruption and should prioritize upgrading to version 2.3.0 to implement necessary input validation and error handling improvements.",
  "technicalDetails": "The root cause of this vulnerability lies in the interaction between 'multer' and its underlying 'append-field' dependency when processing HTTP multipart/form-data payloads.\nThe attack flow initiates when an attacker crafts a malicious request containing two specific text fields. The first field utilizes an exceptionally large numeric value as an array index, which induces the underlying parser to attempt the allocation of a maximum-length sparse array within the Node.js environment.\nFollowing this allocation, a second field is provided within the same request. This field is designed to trigger an append operation that forces the internal data structure to exceed the previously established array length limit. Because the internal state of the sparse array is pushed beyond its capacity, the underlying library throws a RangeError: Invalid array length.\nCrucially, the 'multer' middleware fails to implement a protective try-catch block or robust input sanitization surrounding these array operations. Consequently, the exception remains uncaught, propagating up the call stack until it reaches the Node.js process level. In the event loop, an unhandled RangeError results in the immediate termination of the process, thereby causing a Denial of Service.\nThis exploit is remotely triggerable and does not require the attacker to have administrative privileges or prior authentication. The exploitation is strictly a memory and runtime manipulation technique that capitalizes on the lack of bounds checking for input field names during the parsing process. Because the payload size required to trigger this crash is relatively small, it can easily bypass simple request size limiting mechanisms that do not inspect the internal structure of multipart form fields.\nAll versions of 'multer' prior to 2.3.0 are considered vulnerable. The impact is a complete service crash, which effectively disrupts availability for all concurrent users of the application. The fix implemented in 2.3.0 introduces necessary logic to ensure that input parsing handles sparse array allocations and subsequent appends safely, preventing the unhandled RangeError from reaching the process supervisor."
}