---
id: CVE-2026-82333
aliases:
  - GHSA-535w-7cp7-47q4
title: >-
  multer vulnerable to Denial of Service via oversized array index in field
  names
summary: >-
  multer vulnerable to Denial of Service via oversized array index in field
  names
severity: high
cvss: 7.5
cwe:
  - CWE-400
vendor: multer
product: multer
ecosystem: npm
affected:
  - multer < 2.3.0
patched:
  - multer 2.3.0
published: '2026-09-08'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:28:45Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-535w-7cp7-47q4'
references:
  - url: >-
      https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82333'
  - url: 'https://github.com/expressjs/multer/pull/1438'
  - url: >-
      https://github.com/expressjs/multer/commit/73c1759fa93b87366bc6dbd7abe1b80ddff7d27c
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: 'https://github.com/expressjs/multer/releases/tag/v2.3.0'
  - url: 'https://github.com/advisories/GHSA-535w-7cp7-47q4'
tags:
  - ghsa
  - npm
epss: 0.00488
epssPercentile: 0.39337
ingestedAt: '2026-09-08T22:12:30.967Z'
---

## Overview

### Impact

multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.

### Patches

Users should upgrade to `2.3.0` and configure `limits.fieldArrayIndexLimit` to the minimum array index their application requires.

### Workarounds

None.

## Affected packages

- `multer < 2.3.0`

## Remediation

Upgrade to a patched release:

- `multer 2.3.0`