--- id: CVE-2026-5079 title: >- multer: Multer: Denial of Service via deeply nested field names in multipart form data (CVE-2026-5079) summary: >- A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object stru… severity: high cvss: 7.5 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cvssSource: vendor cwe: - CWE-776 - CWE-400 vendor: Red Hat product: Red Hat Enterprise Linux 10 affected: - logging_subsystem_for_red_hat_openshift - enterprise_linux 10 - enterprise_linux 8 - enterprise_linux 9 - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - developer_hub 1.10 - developer_hub 1.9 patched: - ansible_automation_platform 2.1 - ansible_automation_platform 2.2 - developer_hub 1.10 - developer_hub 1.9 published: '2026-06-15' updated: '2026-09-21' sourceUpdated: '2026-09-21T14:23:23+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5079.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5079.json - url: 'https://access.redhat.com/security/cve/CVE-2026-5079' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2488927' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-5079' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-5079' - url: 'https://cna.openjsf.org/security-advisories.html' - url: >- https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:66003' - url: 'https://access.redhat.com/errata/RHSA-2026:48126' - url: 'https://access.redhat.com/errata/RHSA-2026:49642' - url: 'https://access.redhat.com/errata/RHSA-2026:52768' - url: 'https://github.com/advisories/GHSA-72gw-mp4g-v24j' tags: - csaf - vex - red-hat - ghsa - npm epss: 0.00278 epssPercentile: 0.20571 ecosystem: npm ingestedAt: '2026-06-29T14:31:47.220Z' --- ## Overview A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system. ## Vendor advisories - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:66003** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-09 · [advisory](https://access.redhat.com/errata/RHSA-2026:66003) - **RHSA-2026:48126** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48126) - **RHSA-2026:49642** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49642) - **RHSA-2026:52768** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-08-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:52768) - **Red Hat VEX** · Important · affected: Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5079.json) **multer: Multer: Denial of Service via deeply nested field names in multipart form data** — rated Important by Red Hat. Released 2026-06-15, updated 2026-09-21. Affected: - Logging Subsystem for Red Hat OpenShift - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 Fixed: - Red Hat Ansible Automation Platform 2.1 - Red Hat Ansible Automation Platform 2.2 - Red Hat Developer Hub 1.10 - Red Hat Developer Hub 1.9 No fix planned: - Logging Subsystem for Red Hat OpenShift - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 8 - Red Hat Enterprise Linux 9 Not affected: - Red Hat Developer Hub 1.10 - Red Hat Developer Hub 1.9 - Red Hat Enterprise Linux 10 - Red Hat Enterprise Linux 7 - Red Hat Enterprise Linux 9 - Red Hat Trusted Profile Analyzer ## Remediation For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:65118 For more about Ansible Portal Installer Bootc, see References links https://access.redhat.com/errata/RHSA-2026:66003 For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:48126 Workarounds / mitigations: - To reduce the impact of this denial of service vulnerability, configure the `limits.fields` option within your `multer` instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability. ## Package advisory (CVE-2026-5079) Affected packages: - `multer >= 1.0.0, < 2.2.0` - `multer >= 3.0.0-alpha.1, < 3.0.0-alpha.2` Patched in: - `multer 2.2.0` - `multer 3.0.0-alpha.2` Source: https://github.com/advisories/GHSA-72gw-mp4g-v24j