CVE-2026-77078

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0

Description A denial of service issue exists in the middleware used for handling multipart/form-data in Node.js. A specially crafted multipart request containing two text field names can trigger an uncaught RangeError (Invalid array length), causing the Node.js process to terminate. This occurs when the first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field pushes beyond that length, triggering an error within the append-field dependency that is not handled by the software.

Recommendations Upgrade to version 2.3.0.