{"id":"CVE-2026-77078","aliases":["GHSA-wc9g-mqfw-jrwm"],"title":"multer vulnerable to Denial of Service via crafted multipart field names","summary":"multer vulnerable to Denial of Service via crafted multipart field names","severity":"high","cvss":7.5,"cwe":["CWE-248"],"vendor":"multer","product":"multer","ecosystem":"npm","affected":["multer < 2.3.0"],"patched":["multer 2.3.0"],"published":"2026-09-08","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:30:22Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-wc9g-mqfw-jrwm","references":[{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77078"},{"url":"https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/multer/releases/tag/v2.3.0"},{"url":"https://github.com/advisories/GHSA-wc9g-mqfw-jrwm"}],"tags":["ghsa","npm","exploit-available"],"epss":0.00291,"epssPercentile":0.21869,"ingestedAt":"2026-09-08T22:12:30.967Z","exploits":{"github":1,"githubRepos":["https://github.com/wtfkimi/CVE-2026-77078"],"checkedAt":"2026-09-22T07:11:52.343Z"},"exploitAvailable":true,"slug":"CVE-2026-77078","body":"## Overview\n\n### Impact\n\nA vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.\n\n### Patches\n\nUsers should upgrade to `2.3.0`.\n\n### Workarounds\n\nNone.\n\n## Affected packages\n\n- `multer < 2.3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `multer 2.3.0`","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208899,"id":"CVE-2026-77078","ts":1790061142647,"field":"exploit_available","old":"false","new":"true"}]}