CVE-2026-5079: multer vulnerable to Denial of Service via deeply nested field names

Published Jun 15, 2026
·
Updated

Impact

Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.

Patches

Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.

Workarounds

Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.

Other sources

Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.

Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.

Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.

MITRE

Affected Software

5 affected componentsFixes available
npm/multer>=1.0.0<=2.1.1, =3.0.0-alpha.1
expressjs Multer Node.js>=1.0.0<2.2.0
expressjs Multer Node.js=3.0.0-alpha1
npm/multer>=3.0.0-alpha.1<3.0.0-alpha.2
3.0.0-alpha.2
npm/multer>=1.0.0<2.2.0
2.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade npm/multer to a version that resolves this vulnerability.

    Fixed in 3.0.0-alpha.2
  2. Upgrade

    Upgrade npm/multer to a version that resolves this vulnerability.

    Fixed in 2.2.0
  3. Configuration

    Configure multer's limits.fieldNestingDepth to the minimum nesting depth your application requires to limit parsing of deeply nested bracket notation in field names.

    multer limits.fieldNestingDepth = minimum depth required by the application
  4. Configuration

    Set multer's limits.fields to a reasonable value to reduce the number of fields an attacker can send per request (mitigates impact but does not fully remediate the vulnerability).

    multer limits.fields = reasonable maximum number of fields per request

Event History

Jun 15, 2026
CVE Published
via MITRE·01:56 PM
Data Sourced
via MITRE·01:56 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Jun 17, 2026
Advisory Published
via GitHub·06:12 PM
Data Sourced
via GitHub·06:12 PM
DescriptionSeverityWeaknessAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-5079?

CVE-2026-5079 has a severity rating of high, with a score of 7.5.

2

How does CVE-2026-5079 affect multer?

CVE-2026-5079 affects multer by allowing Denial of Service attacks via deeply nested field names in multipart form data.

3

Which versions of multer are affected by CVE-2026-5079?

multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are affected by CVE-2026-5079.

4

How can I mitigate CVE-2026-5079?

To mitigate CVE-2026-5079, upgrade to a version of multer that is not affected by this vulnerability.

5

What type of attack is possible with CVE-2026-5079?

CVE-2026-5079 allows attackers to perform a Denial of Service attack by exploiting deeply nested field names.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203