Multer vulnerable to Denial of Service via deeply nested field names
Published 17 Jun 2026 · Updated 17 Jun 2026
Affected packages
- Affected
- >=1.0.0 <2.2.0
- Fixed in
- 2.2.0
npm install multer@2.2.0- Affected
- >=3.0.0-alpha.1 <3.0.0-alpha.2
- Fixed in
- 3.0.0-alpha.2
npm install multer@3.0.0-alpha.2Details
Impact
Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches
Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.
Workarounds
Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
Is GHSA-72gw-mp4g-v24j in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected multer, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.