CVE-2026-5079: multer vulnerable to Denial of Service via deeply nested field names
Impact
Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches
Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.
Workarounds
Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
Other sources
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 3.0.0-alpha.2 - Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.2.0 - Configuration
Configure multer's limits.fieldNestingDepth to the minimum nesting depth your application requires to limit parsing of deeply nested bracket notation in field names.
multer limits.fieldNestingDepth = minimum depth required by the application - Configuration
Set multer's limits.fields to a reasonable value to reduce the number of fields an attacker can send per request (mitigates impact but does not fully remediate the vulnerability).
multer limits.fields = reasonable maximum number of fields per request
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5079?
CVE-2026-5079 has a severity rating of high, with a score of 7.5.
How does CVE-2026-5079 affect multer?
CVE-2026-5079 affects multer by allowing Denial of Service attacks via deeply nested field names in multipart form data.
Which versions of multer are affected by CVE-2026-5079?
multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are affected by CVE-2026-5079.
How can I mitigate CVE-2026-5079?
To mitigate CVE-2026-5079, upgrade to a version of multer that is not affected by this vulnerability.
What type of attack is possible with CVE-2026-5079?
CVE-2026-5079 allows attackers to perform a Denial of Service attack by exploiting deeply nested field names.