SB2026090288 - Multiple vulnerabilities in multer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090288

SB2026090288 - Multiple vulnerabilities in multer

Published: September 2, 2026

Security Bulletin ID SB2026090288
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 75% Low 25%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2026-82333)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the append-field dependency used by multer when parsing multipart field names with crafted bracket notation. A remote attacker can send a specially crafted HTTP request with an oversized array index in a field name to cause a denial of service.

A single crafted multipart request is sufficient to trigger synchronous CPU consumption that prevents the process from handling other requests.


2) Uncaught Exception (CVE-ID: CVE-2026-77078)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an uncaught exception in multer field parsing when processing a crafted multipart/form-data request. A remote attacker can send specially crafted text field names to cause a denial of service.

A single multipart/form-data request can trigger a RangeError: Invalid array length that terminates the Node.js process instead of being routed to the application error handler.


3) Race condition (CVE-ID: CVE-2026-77063)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass file size restrictions on uploaded files.

The vulnerability exists due to a race condition in the asynchronous fileFilter handling in multer when processing file uploads with an asynchronous fileFilter. A remote attacker can upload an oversized file to bypass file size restrictions on uploaded files.

Only uploads using an asynchronous fileFilter are affected; uploads using a synchronous fileFilter are not affected.


4) Incomplete cleanup (CVE-ID: CVE-2026-77037)

CWE-ID: CWE-459 - Incomplete cleanup

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to incomplete cleanup in diskStorage when handling aborted or truncated multipart uploads. A remote attacker can abort or truncate multipart upload requests to cause a denial of service.

Each failed request can leak an open file descriptor and retain its disk blocks until the process exits. Only applications using disk storage are vulnerable.


Remediation

Install update from vendor's website.

References