---
id: CVE-2026-77078
aliases:
  - GHSA-wc9g-mqfw-jrwm
title: multer vulnerable to Denial of Service via crafted multipart field names
summary: multer vulnerable to Denial of Service via crafted multipart field names
severity: high
cvss: 7.5
cwe:
  - CWE-248
vendor: multer
product: multer
ecosystem: npm
affected:
  - multer < 2.3.0
patched:
  - multer 2.3.0
published: '2026-09-08'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:30:22Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-wc9g-mqfw-jrwm'
references:
  - url: >-
      https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77078'
  - url: >-
      https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/expressjs/multer/releases/tag/v2.3.0'
  - url: 'https://github.com/advisories/GHSA-wc9g-mqfw-jrwm'
tags:
  - ghsa
  - npm
  - exploit-available
epss: 0.00488
epssPercentile: 0.39333
ingestedAt: '2026-09-08T22:12:30.967Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/wtfkimi/CVE-2026-77078'
  checkedAt: '2026-09-25T08:21:13.602Z'
exploitAvailable: true
---

## Overview

### Impact

A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single `multipart/form-data` request. Two specially crafted text field names cause an uncaught `RangeError: Invalid array length` inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.

### Patches

Users should upgrade to `2.3.0`.

### Workarounds

None.

## Affected packages

- `multer < 2.3.0`

## Remediation

Upgrade to a patched release:

- `multer 2.3.0`