Packages / multer / Security

HighVulnerabilityGHSA-wc9g-mqfw-jrwmCVE-2026-77078Published 8 Sep 2026

multer vulnerable to Denial of Service via crafted multipart field names

Your version

Affected releases · multer

  • 2.x2.0.0 – 2.2.0Fixed in 2.3.0
  • 1.x and older0.0.1 – 1.4.4No fix, no longer updated

On 2.x, the newest line:

npm install multer@2.3.0
Every release on a timeline
2.x

  1. Affected

    2.0.0 – 2.2.0

    6 releases

  2. Fixed

    2.3.0 – 2.5.0

    3 releases, latest

1.x

  1. Affected

    1.0.0 – 1.4.4

    17 releases

0.x

  1. Affected

    0.0.1 – 0.1.8

    15 releases

41 stable releases of multer, oldest to newest, one row per major.

What happens

Impact

A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.

Patches

Users should upgrade to 2.3.0.

Workarounds

None.