CVE-2026-82333

Analyzed Analyzed - Analysis Complete

Denial of Service in multer via Sparse Array Iteration

Publication date: 2026-08-28

Last updated on: 2026-09-02

Assigner: openjs

Description

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-82333

Affected Vendors & Products

Vendor	Product	Version / Range
expressjs	multer	to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This is a denial of service vulnerability in the multer Node.js middleware. It occurs when specially crafted multipart form data with two text fields triggers synchronous iteration over a maximum-length sparse array in the field parser. This blocks the event loop, preventing the process from handling other requests.

Detection Guidance

Detecting this vulnerability requires checking if your system uses a vulnerable version of multer (before 2.3.0). Inspect your Node.js application dependencies for multer and verify the version. No specific commands are provided for detection beyond dependency checks.

Impact Analysis

An attacker could send malicious requests to your Node.js application using multer, causing the server to become unresponsive. This could lead to degraded performance, crashes, or complete unavailability of your service for legitimate users.

Compliance Impact

This vulnerability causes a denial of service by blocking the event loop, which could disrupt services handling sensitive data. For GDPR, this may impact availability of personal data processing systems. For HIPAA, it could affect the availability of systems handling protected health information.

Mitigation Strategies

Upgrade multer to version 2.3.0 or later. Configure the fieldArrayIndexLimit option to reject oversized array indexes. Set limits.fieldArrayIndexLimit to the largest array index your application requires.

Hi! I’m here to help you understand CVE-2026-82333. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70