TI-2026-53831 Aliases CVE-2026-77078 GHSA-wc9g-mqfw-jrwm

multer vulnerable to Denial of Service via crafted multipart field names

LOW 39CWE-248Published 2026-08-28 · Updated 2026-08-31

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-248.

Summary

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00488 42nd percentileScored 2026-11-07

Fix Partial multer (multer): 2.3.0multer (npm): 2.3.0Red Hat: 2 advisoriesRed Hat: 1 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
expressjs	multer	before 2.3.0	2.3.0	Patch available	CNA
—	multer (npm)	before 2.3.0	2.3.0	Patch available	GHSA-wc9g-mqfw-jrwm

multer Vendorexpressjs Affected before 2.3.0 Fixed in 2.3.0 Patch available CNA
multer (npm) Vendor— Affected before 2.3.0 Fixed in 2.3.0 Patch available GHSA-wc9g-mqfw-jrwm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:expressjs:multer::::::node.js::*	before 2.3.0	Vulnerable	expressjs

cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:* Versions before 2.3.0 Vulnerable ·expressjs

Remediation

Fix · CNA multer (multer) Fixed in 2.3.0
Fix · GHSA-wc9g-mqfw-jrwm multer (npm) Fixed in 2.3.0 Advisory →

Red Hat 2 advisories

RHSA-2026:79088 Released 2026-10-08 · Red Hat rating Critical
Red Hat Developer Hub 1.10.5 release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
RHSA-2026:76788 Released 2026-10-06 · Red Hat rating Critical
Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.
- Red Hat Developer Hub 1.10 registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend, registry.redhat.io/rhdh/red-hat-developer-hub-backstage-plugin-orchestrator +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-08-28
multer 2.3.0
4 records Highest priority Priority LOW 4 LOW
Other records, highest priority first
- TI-2026-56780 multer vulnerable to Denial of Service via oversized array index in field namesPriority LOW 39
- TI-2026-53816 multer vulnerable to Denial of Service via file descriptor leak on aborted uploadsPriority LOW 39
- TI-2026-53818 multer vulnerable to file size limit bypass via async fileFilter race conditionPriority LOW 17
Show all 4 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Self-service automation portal 2	Affected	—
Red Hat Developer Hub 1.10	Fixed	RHSA-2026:76788, RHSA-2026:79088

Not affected: 2 products

Red Hat 3scale API Management Platform 2
Red Hat Developer Hub 1.10

Timeline

2026-10-02 Threatist record created from CVE-2026-77078
2026-10-03 Alias added: GHSA-wc9g-mqfw-jrwm
2026-10-07 Fix available: RHSA-2026:76788 · Red Hat
2026-10-07 Fix available: Red Hat Developer Hub 1.10 · Red Hat
2026-10-09 Fix available: RHSA-2026:79088 · Red Hat
2026-10-09 Affected versions changed · Red Hat

References

Advisory 3

Other 3

TI-2026-03033 Multer vulnerable to Denial of Service via uncontrolled recursion CVSS 4.0HIGH 8.7
TI-2026-02853 Multer vulnerable to Denial of Service via incomplete cleanup CVSS 4.0HIGH 8.7
TI-2026-01995 Multer vulnerable to Denial of Service via resource exhaustion CVSS 4.0HIGH 8.7
TI-2026-56780 multer vulnerable to Denial of Service via oversized array index in field names CVSS 3.1HIGH 7.5
TI-2026-53816 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads CVSS 3.1HIGH 7.5
TI-2026-04434 multer vulnerable to Denial of Service via deeply nested field names CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences