---
title: "GHSA-535w-7cp7-47q4: multer vulnerable to Denial of Service via oversized array index in field names"
description: "High severity. multer vulnerable to Denial of Service via oversized array index in field names. Affects multer; fixed in 2.3.0."
url: https://inlinr.com/advisories/GHSA-535w-7cp7-47q4
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-535w-7cp7-47q4 CVE-2026-82333 Published 8 Sep 2026

# multer vulnerable to Denial of Service via oversized array index in field names

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.2.0 Fixed in 2.3.0
- 1.x and older 0.0.1 – 1.4.4 No fix, no longer updated

On 2.x, the newest line:

```
npm install multer@2.3.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.2.0  
6 releases
2. Fixed

2.3.0 – 2.5.0  
3 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

0.x 

1. Affected

0.0.1 – 0.1.8  
15 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.

Patches

Users should upgrade to `2.3.0` and configure `limits.fieldArrayIndexLimit` to the minimum array index their application requires.

Workarounds

None.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4 "https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-82333 "https://nvd.nist.gov/vuln/detail/CVE-2026-82333")  
nvd.nist.gov/vuln/detail/CVE-2026-82333
- [Pull request](https://github.com/expressjs/multer/pull/1438 "https://github.com/expressjs/multer/pull/1438")  
#1438
- [Fix commit](https://github.com/expressjs/multer/commit/73c1759fa93b87366bc6dbd7abe1b80ddff7d27c "https://github.com/expressjs/multer/commit/73c1759fa93b87366bc6dbd7abe1b80ddff7d27c")  
73c1759
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://github.com/expressjs/multer/releases/tag/v2.3.0 "https://github.com/expressjs/multer/releases/tag/v2.3.0")  
github.com/expressjs/multer/releases/tag/v2.3.0