high · 7.5CVE-2026-77078Sep 8, 2026

CVE-2026-77078: multer Denial of Service via Crafted Multipart Field Names

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A two-field multipart request with oversized numeric array indexes in field names crashes any Node.js server running multer, making it instantly and remotely killable by an unauthenticated attacker.

Packagemulter
Ecosystemnpm
Affected< 2.3.0
Fixed in2.3.0
CVE-2026-77078: multer Denial of Service via Crafted Multipart Field Names

The problem

multer passes raw field names directly to the append-field dependency for parsing without wrapping the call in an error handler.

Sending a first field named x[4294967294] forces JavaScript to allocate a sparse array at the maximum legal array length. A second field named x[4294967295] (or any subsequent push) then tries to extend the array past that limit, throwing an uncaught RangeError: Invalid array length that bypasses Express error middleware and terminates the Node.js process.

No authentication, no file upload, and no large body are required.

Proof of concept

A working proof-of-concept for CVE-2026-77078 in multer, with the exact payload below.

http
POST /upload HTTP/1.1
Host: target.example.com
Content-Type: multipart/form-data; boundary=----Boundary

------Boundary
Content-Disposition: form-data; name="x[4294967294]"

a
------Boundary
Content-Disposition: form-data; name="x[4294967295]"

b
------Boundary--

JavaScript arrays are capped at 2^32-2 elements (index 4294967294). The append-field library resolves bracket-notation field names into nested objects or arrays, so x[4294967294] allocates a sparse array at the absolute maximum length. When append-field then processes x[4294967295], it attempts to push past that boundary and JavaScript throws RangeError: Invalid array length.

Because multer's field handler does not wrap the append-field call in a try/catch, the exception propagates as an uncaught exception and kills the process outright. The fix in commit 87a584e (v2.3.0) adds error handling around the append-field call so the exception is caught, the request is rejected with a proper multer error, and the process stays alive.

The fix

Upgrade multer to 2.3.0 or later (npm install multer@latest). No workaround exists for older versions. The patch commit is 87a584e8c8d4da873292635fa1d8c4d78d985b76.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research