O4Fdev

**Name of the Vulnerable Software and Affected Versions** multer versions prior to 2.3.0 **Description** A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A specially crafted multipart request containing two text field names can trigger an uncaught RangeError (Invalid array length), causing the Node.js process to terminate. This occurs when the first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field pushes beyond that length, triggering an error within the append-field dependency that is not handled by the software. **Recommendations** Upgrade to version 2.3.0.

**Name of the Vulnerable Software and Affected Versions** multer versions prior to 2.3.0 **Description** A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A remote attacker can block the event loop by sending a multipart request containing two specially crafted text field names. The first field uses a large numeric array index to allocate a maximum-length sparse array, and a second field with a non-numeric key triggers a full-length synchronous iteration within the append-field dependency, preventing the process from handling other requests. **Recommendations** Upgrade to version 2.3.0 and configure the `limits.fieldArrayIndexLimit` option to the maximum array index required by the application.