GHSA-535w-7cp7-47q4

Suggest an improvement
Source
https://github.com/advisories/GHSA-535w-7cp7-47q4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-535w-7cp7-47q4/GHSA-535w-7cp7-47q4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-535w-7cp7-47q4
Aliases
Downstream
Published
2026-09-08T21:28:43Z
Modified
2026-09-08T21:45:04Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
multer vulnerable to Denial of Service via oversized array index in field names
Details

Impact

multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items[4294967294] forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.

Patches

Users should upgrade to 2.3.0 and configure limits.fieldArrayIndexLimit to the minimum array index their application requires.

Workarounds

None.

Database specific 
{
    "cwe_ids": [
        "CWE-400"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T21:28:43Z",
    "nvd_published_at": "2026-08-28T22:16:57Z",
    "severity": "HIGH"
}
References

Affected packages

npm / multer

Package

Name
multer
View open source insights on deps.dev
Purl
pkg:npm/multer

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-535w-7cp7-47q4/GHSA-535w-7cp7-47q4.json"