Vulnerability · Published Aug 28, 2026 · Assigned by openjs
CVE-2026-82333multer vulnerable to Denial of Service via oversized array index in field names
High 7.5
In plain English
A high-severity uncontrolled resource consumption in multer from multer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | node-multer | 2.4.0+~cs3.2.0-1 | DEBIAN-CVE-2026-82333 |
| npm | multer | 2.3.0 | GHSA-535w-7cp7-47q4 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H