---
title: "GHSA-72gw-mp4g-v24j: Multer vulnerable to Denial of Service via deeply nested field names"
description: "High severity. Multer vulnerable to Denial of Service via deeply nested field names. Affects multer; fixed in 2.2.0."
url: https://inlinr.com/advisories/GHSA-72gw-mp4g-v24j
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-72gw-mp4g-v24j CVE-2026-5079 Published 17 Jun 2026

# Multer vulnerable to Denial of Service via deeply nested field names

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.1.1 Fixed in 2.2.0
- 1.x 1.0.0 – 1.4.4 No fix on this line yet

On 2.x, the newest line:

```
npm install multer@2.2.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.1.1  
5 releases
2. Fixed

2.2.0 – 2.5.0  
4 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The `append-field` dependency parses bracket notation in field names (e.g., `a[b][c]`) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.

Patches

Users should upgrade to `2.2.0` and configure `limits.fieldNestingDepth` to the minimum depth their application requires.

Workarounds

Set `limits.fields` to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j "https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-5079 "https://nvd.nist.gov/vuln/detail/CVE-2026-5079")  
nvd.nist.gov/vuln/detail/CVE-2026-5079
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer