CVE-2026-82333

multer 1.x and 2.x, an npm middleware for parsing multipart form data in Node.js applications, is vulnerable to a denial-of-service flaw (CWE-400) in how its append-field dependency handles bracket notation in field names. A single unauthenticated HTTP request with a crafted multipart body, using a field name with a very large numeric index such as items[4294967294], forces allocation of a maximum-length sparse array, and a following field with a non-numeric key on the same base converts that array to an object by iterating its full length. This consumes CPU synchronously and leaves the process unable to handle other requests, giving an attacker complete availability disruption of the affected service with one request. Any Node.js application using multer 1.x or 2.x to accept multipart uploads is affected. No public proof-of-concept or in-the-wild exploitation is known, and the EPSS model estimates only about a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade to multer 2.3.0 and configure the new limits.fieldArrayIndexLimit to the smallest maximum array index your application requires; no workaround is available. Use npm audit or equivalent dependency scanning to find multer 1.x/2.x in application trees, and prioritize internet-facing Node.js services that accept multipart uploads, since a single crafted request can stall the entire process.