CVE-2026-77078

Analyzed Analyzed - Analysis Complete

Denial of Service in Multer via Sparse Array Exploit

Publication date: 2026-08-28

Last updated on: 2026-09-02

Assigner: openjs

Description

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-77078

Affected Vendors & Products

Vendor	Product	Version / Range
expressjs	multer	to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in the multer middleware for Node.js. It occurs when a specially crafted multipart request with two text fields triggers an uncaught RangeError due to an invalid array length. The first field allocates a very large sparse array, and the second field pushes past that length, causing the Node.js process to terminate.

Detection Guidance

Detecting this vulnerability requires checking the version of multer in use. Run npm list multer or check your package.json to verify if the installed version is below 2.3.0.

Impact Analysis

This vulnerability can cause your Node.js application to crash unexpectedly when processing certain multipart requests. This leads to downtime and service disruption for users relying on the application. It can be triggered remotely without authentication, making it a significant risk for exposed services.

Compliance Impact

This vulnerability could impact compliance by causing service unavailability, which may violate availability requirements in GDPR and HIPAA. Unplanned downtime could lead to data processing interruptions, potentially breaching regulatory obligations for timely access or processing of personal or health data.

Mitigation Strategies

Upgrade multer to version 2.3.0 or later immediately using npm update multer@2.3.0. This fixes the uncaught RangeError that causes denial of service.

Hi! I’m here to help you understand CVE-2026-77078. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70