CVE-2026-3520: Multer vulnerable to Denial of Service via uncontrolled recursion
Impact
A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.
Patches
Users should upgrade to 2.1.1
Workarounds
None
Resources
- https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2 - https://www.cve.org/CVERecord?id=CVE-2026-3520 - https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752 - https://cna.openjsf.org/security-advisories.html
Other sources
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.1.1 - Upgrade
Upgrade
Multerto a version that resolves this vulnerability.Fixed in 2.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3520?
CVE-2026-3520 has a high severity rating due to its potential to cause a Denial of Service (DoS) through stack overflow.
How do I fix CVE-2026-3520?
To fix CVE-2026-3520, upgrade Multer to version 2.1.1 or later.
What versions of Multer are affected by CVE-2026-3520?
Multer versions prior to 2.1.1 are affected by CVE-2026-3520.
What kind of attack is possible with CVE-2026-3520?
CVE-2026-3520 allows for a Denial of Service attack through uncontrolled recursion by sending malformed requests.
Is CVE-2026-3520 related to specific software?
Yes, CVE-2026-3520 specifically impacts the Multer middleware for Node.js applications.