---
title: "GHSA-5528-5vmv-3xc2: Multer Vulnerable to Denial of Service via Uncontrolled Recursion"
description: "High severity. Multer Vulnerable to Denial of Service via Uncontrolled Recursion. Affects multer; fixed in 2.1.1."
url: https://inlinr.com/advisories/GHSA-5528-5vmv-3xc2
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-5528-5vmv-3xc2 CVE-2026-3520 Published 5 Mar 2026

# Multer Vulnerable to Denial of Service via Uncontrolled Recursion

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.1.0 Fixed in 2.1.1
- 1.x and older 0.0.1 – 1.4.4 No fix, no longer updated

On 2.x, the newest line:

```
npm install multer@2.1.1
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.1.0  
4 releases
2. Fixed

2.1.1 – 2.5.0  
5 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

0.x 

1. Affected

0.0.1 – 0.1.8  
15 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.

Patches

Users should upgrade to `2.1.1`

Workarounds

None

Resources

- [github.com/expressjs/multer/security/advisories…](https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2 "https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2")
- [cve.org/CVERecord](https://www.cve.org/CVERecord?id=CVE-2026-3520 "https://www.cve.org/CVERecord?id=CVE-2026-3520")
- [7e66481](https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752 "https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752")
- [cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:4.0/​AV:N/​AC:L/​AT:N/​PR:N/​UI:N/​VC:N/​VI:N/​VA:H/​SC:N/​SI:N/​SA:N

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2 "https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3520 "https://nvd.nist.gov/vuln/detail/CVE-2026-3520")  
nvd.nist.gov/vuln/detail/CVE-2026-3520
- [Fix commit](https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752 "https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752")  
7e66481
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://www.cve.org/CVERecord?id=CVE-2026-3520 "https://www.cve.org/CVERecord?id=CVE-2026-3520")  
cve.org/CVERecord