{"id":"CVE-2026-5079","title":"multer: Multer: Denial of Service via deeply nested field names in multipart form data (CVE-2026-5079)","summary":"A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object stru…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":["CWE-776","CWE-400"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","affected":["logging_subsystem_for_red_hat_openshift","enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","ansible_automation_platform 2.1","ansible_automation_platform 2.2","developer_hub 1.10","developer_hub 1.9"],"patched":["ansible_automation_platform 2.1","ansible_automation_platform 2.2","developer_hub 1.10","developer_hub 1.9"],"published":"2026-06-15","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:23:23+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5079.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5079.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-5079"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2488927"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5079"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5079"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j"},{"url":"https://access.redhat.com/errata/RHSA-2026:65118"},{"url":"https://access.redhat.com/errata/RHSA-2026:66003"},{"url":"https://access.redhat.com/errata/RHSA-2026:48126"},{"url":"https://access.redhat.com/errata/RHSA-2026:49642"},{"url":"https://access.redhat.com/errata/RHSA-2026:52768"},{"url":"https://github.com/advisories/GHSA-72gw-mp4g-v24j"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00278,"epssPercentile":0.20527,"ecosystem":"npm","ingestedAt":"2026-06-29T14:31:47.220Z","slug":"CVE-2026-5079","body":"## Overview\n\nA flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system.\n\n## Vendor advisories\n\n- **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118)\n- **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003)\n- **RHSA-2026:48126** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48126)\n- **RHSA-2026:49642** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49642)\n- **RHSA-2026:52768** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52768)\n- **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5079.json)\n\n**multer: Multer: Denial of Service via deeply nested field names in multipart form data** — rated Important by Red Hat. Released 2026-06-15, updated 2026-09-21.\n\nAffected:\n\n- Logging Subsystem for Red Hat OpenShift\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nFixed:\n\n- Red Hat Ansible Automation Platform 2.1\n- Red Hat Ansible Automation Platform 2.2\n- Red Hat Developer Hub 1.10\n- Red Hat Developer Hub 1.9\n\nNo fix planned:\n\n- Logging Subsystem for Red Hat OpenShift\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\nNot affected:\n\n- Red Hat Developer Hub 1.10\n- Red Hat Developer Hub 1.9\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 9\n- Red Hat Trusted Profile Analyzer\n\n## Remediation\n\nFor more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:65118\nFor more about Ansible Portal Installer Bootc, see References links https://access.redhat.com/errata/RHSA-2026:66003\nFor more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:48126\n\nWorkarounds / mitigations:\n\n- To reduce the impact of this denial of service vulnerability, configure the `limits.fields` option within your `multer` instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability.\n\n## Package advisory (CVE-2026-5079)\n\nAffected packages:\n\n- `multer >= 1.0.0, < 2.2.0`\n- `multer >= 3.0.0-alpha.1, < 3.0.0-alpha.2`\n\nPatched in:\n\n- `multer 2.2.0`\n- `multer 3.0.0-alpha.2`\n\nSource: https://github.com/advisories/GHSA-72gw-mp4g-v24j","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}