CVE-2026-77078

Multer, a widely used Node.js middleware for parsing multipart/form-data requests, contains a denial-of-service flaw in its field-name parsing. A remote, unauthenticated attacker can crash the hosting Node.js process with a single multipart request containing two specially crafted text field names, which trigger an uncaught 'RangeError: Invalid array length' that is not routed to the application's error handler. The attacker gains full availability disruption of the affected service, requiring a process restart. All applications that use multer to parse multipart requests are affected. There is no known public proof-of-concept, exploitation is not listed in CISA KEV, and EPSS puts 30-day exploitation probability at a low 0.3%.

What to do: Upgrade multer to 2.3.0 in all Node.js projects, checking package.json/lockfiles and transitively dependent packages since many apps pull it in via frameworks. There is no workaround, so until patched consider process managers or restart-on-crash supervision to limit downtime, and restrict or rate-limit unauthenticated multipart upload endpoints if feasible.