CVE-2026-5079: Multer Denial of Service via Nested Field Names

Technical summary

CVE-2026-5079 is a Denial of Service vulnerability in multer's multipart form data parsing. The underlying append-field dependency processes bracket notation in field names (e.g., 'field[nested][deeper]') and constructs corresponding nested object structures with no depth limit. An attacker can send a single request containing field names with extreme nesting levels, forcing the parser to allocate deeply nested objects that exhaust memory and CPU resources. The vulnerability is network-accessible, requires no privilege, and has low attack complexity. It impacts the availability pillar exclusively (CWE-400: Uncontrolled Resource Consumption).

Business impact

Applications using vulnerable multer versions in production environments face direct availability risk. A single crafted request from an unauthenticated attacker can consume sufficient resources to degrade or crash the service, affecting end users and potentially disrupting critical workflows. Organizations relying on multer for file uploads (common in REST APIs, web forms, and admin panels) should assess exposure immediately. The attack requires no malware, compromised credentials, or complex social engineering—only network access to the application endpoint.

Affected systems

This vulnerability affects Express.js applications using multer 1.0.0 through 2.1.1 (stable 2.x branch) and 3.0.0-alpha.1 (prerelease 3.x). Organizations should audit their package.json and package-lock.json to identify direct and transitive dependencies on multer. Applications that do not perform file uploads or multipart form data processing are not affected. The 3.x prerelease is less common in production, but development and staging environments may expose it.

Exploitability

Exploitation is straightforward and requires only an HTTP client and knowledge of the application's multipart endpoint URL. No advanced tools, authentication, or user interaction are necessary. A proof-of-concept would be a POST request with a Content-Type: multipart/form-data header and a field name such as 'a[b][c]...[z]' repeated with sufficient depth to trigger resource exhaustion. The attack surface is broad—any exposed file upload endpoint becomes a potential entry point. This vulnerability does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the published date, but the low barrier to exploitation makes active monitoring advisable.

Remediation

Upgrade multer to version 2.2.0 (for the 2.x line) or 3.0.0-alpha.2 (for the 3.x prerelease). After upgrading, configure the new limits.fieldNestingDepth option to the minimum nesting depth your application legitimately requires. For example, if your forms only use single-level brackets like 'user[name]', set fieldNestingDepth to 2. As an interim workaround without upgrading, enforce a reasonable limits.fields value to restrict the total number of fields per request, which partially mitigates the issue by limiting the attacker's ability to create many nested structures, but does not eliminate the underlying vulnerability.

Patch guidance

Verify the current multer version in your dependency tree using 'npm list multer' or 'yarn list multer'. For applications on the 2.x stable branch, upgrade to 2.2.0 or later. For those on 3.x (including prerelease), upgrade to 3.0.0-alpha.2 or later. After patching, update your multer configuration to include limits: { fieldNestingDepth: <your_minimum> } based on your application's actual form structure. Test file upload functionality in a staging environment before deploying to production. If you maintain a monorepo or have pinned versions, ensure the upgrade propagates to all affected projects.

Detection guidance

Monitor application logs and metrics for sudden spikes in CPU usage or memory consumption correlated with HTTP requests to file upload endpoints. Network-level detection is challenging because the malicious payload is a single HTTP request; however, anomalous field name patterns (excessive brackets or unusual depth) in multipart form data can trigger alerting if your WAF or middleware logs field names. Application-level detection: configure logging or middleware to reject requests with field names exceeding a reasonable nesting depth (e.g., > 5 levels) and alert on rejections. Request size limits and timeouts can also reduce the blast radius of a successful exploit.

Why prioritize this

This vulnerability warrants prompt attention due to its CVSS 7.5 HIGH severity score, network-accessible attack surface, and simplicity of exploitation. The attack requires no authentication or user interaction, and a single request suffices to impact availability. While not yet in active public exploitation (KEV status is false), the low technical barrier means organized threat actors or opportunistic attackers may develop exploitation scripts. Prioritize patching for internet-facing or DMZ-deployed applications accepting file uploads; internal applications with restricted network access can follow a standard patching window.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a HIGH severity: the attack vector is network-based (AV:N), attack complexity is low (AC:L), no privileges or user interaction are required (PR:N, UI:N), and the scope is unchanged (S:U). The impact is exclusively on availability (A:H), with no confidentiality or integrity compromise. The score does not account for environmental factors (e.g., whether the application is internet-facing or internal), so organizations should adjust their risk profile based on exposure and criticality of the affected service.

Frequently asked questions