CVE-2026-5079

Name of the Vulnerable Software and Affected Versions multer versions 1.0.0 through 2.1.1 multer version 3.0.0-alpha.1

Description A Denial of Service issue exists due to the way the append-field dependency parses bracket notation in field names within multipart form data. Because there is no limit on nesting depth, an attacker can send a single HTTP request with a crafted multipart body to force the allocation of deeply nested object structures, leading to excessive CPU and memory consumption.

Recommendations For versions 1.0.0 through 2.1.1, upgrade to version 2.2.0 and configure the limits.fieldNestingDepth option to the minimum depth required by the application. For version 3.0.0-alpha.1, upgrade to version 3.0.0-alpha.2 and configure the limits.fieldNestingDepth option to the minimum depth required by the application. As a temporary mitigation, set limits.fields to a reasonable value to reduce the number of fields allowed per request.