Resource exhaustion in multer - CVE-2026-82333
Published: September 2, 2026
Vulnerability identifier: #VU146778
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-82333
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource consumption in the append-field dependency used by multer when parsing multipart field names with crafted bracket notation. A remote attacker can send a specially crafted HTTP request with an oversized array index in a field name to cause a denial of service.
A single crafted multipart request is sufficient to trigger synchronous CPU consumption that prevents the process from handling other requests.
Affected software
multer
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Automation Assets in IBM Cloud Pak for Integration (CP4I)
How to mitigate CVE-2026-82333
Install security update from vendor's website.
multer - update to 2.3.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3