---
title: "GHSA-wc9g-mqfw-jrwm: multer vulnerable to Denial of Service via crafted multipart field names"
description: "High severity. multer vulnerable to Denial of Service via crafted multipart field names. Affects multer; fixed in 2.3.0."
url: https://inlinr.com/advisories/GHSA-wc9g-mqfw-jrwm
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-wc9g-mqfw-jrwm CVE-2026-77078 Published 8 Sep 2026

# multer vulnerable to Denial of Service via crafted multipart field names

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.2.0 Fixed in 2.3.0
- 1.x and older 0.0.1 – 1.4.4 No fix, no longer updated

On 2.x, the newest line:

```
npm install multer@2.3.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.2.0  
6 releases
2. Fixed

2.3.0 – 2.5.0  
3 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

0.x 

1. Affected

0.0.1 – 0.1.8  
15 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.

Patches

Users should upgrade to `2.3.0`.

Workarounds

None.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm "https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-77078 "https://nvd.nist.gov/vuln/detail/CVE-2026-77078")  
nvd.nist.gov/vuln/detail/CVE-2026-77078
- [Fix commit](https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76 "https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76")  
87a584e
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://github.com/expressjs/multer/releases/tag/v2.3.0 "https://github.com/expressjs/multer/releases/tag/v2.3.0")  
github.com/expressjs/multer/releases/tag/v2.3.0