multer vulnerable to Denial of Service via crafted multipart field names
Published 8 Sept 2026 · Updated 8 Sept 2026
Affected package
- Affected
- <2.3.0
- Fixed in
- 2.3.0
npm install multer@2.3.0Details
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Is GHSA-wc9g-mqfw-jrwm in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected multer, and gives you the command that fixes it.
References
- Linkgithub.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm
- Advisorynvd.nist.gov/vuln/detail/CVE-2026-77078
- Linkgithub.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76
- Linkcna.openjsf.org/security-advisories.html
- Packagegithub.com/expressjs/multer
- Linkgithub.com/expressjs/multer/releases/tag/v2.3.0
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.