Uncaught Exception in multer - CVE-2026-77078
Published: September 2, 2026
Vulnerability identifier: #VU146779
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77078
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uncaught exception in multer field parsing when processing a crafted multipart/form-data request. A remote attacker can send specially crafted text field names to cause a denial of service.
A single multipart/form-data request can trigger a RangeError: Invalid array length that terminates the Node.js process instead of being routed to the application error handler.
Affected software
multer
Automation Assets in IBM Cloud Pak for Integration (CP4I)
Automation Assets in IBM Cloud Pak for Integration (CP4I)
How to mitigate CVE-2026-77078
Install security update from vendor's website.
multer - update to 2.3.0
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3
Automation Assets in IBM Cloud Pak for Integration (CP4I) - addressed in versions 4.0.26-sc2, 4.4.3