Packages / multer / Security

HighVulnerabilityGHSA-535w-7cp7-47q4CVE-2026-82333Published 8 Sep 2026

multer vulnerable to Denial of Service via oversized array index in field names

Your version

Affected releases · multer

  • 2.x2.0.0 – 2.2.0Fixed in 2.3.0
  • 1.x and older0.0.1 – 1.4.4No fix, no longer updated

On 2.x, the newest line:

npm install multer@2.3.0
Every release on a timeline
2.x

  1. Affected

    2.0.0 – 2.2.0

    6 releases

  2. Fixed

    2.3.0 – 2.5.0

    3 releases, latest

1.x

  1. Affected

    1.0.0 – 1.4.4

    17 releases

0.x

  1. Affected

    0.0.1 – 0.1.8

    15 releases

41 stable releases of multer, oldest to newest, one row per major.

What happens

Impact

multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items[4294967294] forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.

Patches

Users should upgrade to 2.3.0 and configure limits.fieldArrayIndexLimit to the minimum array index their application requires.

Workarounds

None.