CVE-2026-82333

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0

Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A remote attacker can block the event loop by sending a multipart request containing two specially crafted text field names. The first field uses a large numeric array index to allocate a maximum-length sparse array, and a second field with a non-numeric key triggers a full-length synchronous iteration within the append-field dependency, preventing the process from handling other requests.

Recommendations Upgrade to version 2.3.0 and configure the limits.fieldArrayIndexLimit option to the maximum array index required by the application.