Packages / multer / Security

HighVulnerabilityGHSA-72gw-mp4g-v24jCVE-2026-5079Published 17 Jun 2026

Multer vulnerable to Denial of Service via deeply nested field names

Your version

Affected releases · multer

  • 2.x2.0.0 – 2.1.1Fixed in 2.2.0
  • 1.x1.0.0 – 1.4.4No fix on this line yet

On 2.x, the newest line:

npm install multer@2.2.0
Every release on a timeline
2.x

  1. Affected

    2.0.0 – 2.1.1

    5 releases

  2. Fixed

    2.2.0 – 2.5.0

    4 releases, latest

1.x

  1. Affected

    1.0.0 – 1.4.4

    17 releases

41 stable releases of multer, oldest to newest, one row per major.

What happens

Impact

Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.

Patches

Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.

Workarounds

Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.