CVE-2026-5079
multer vulnerable to Denial of Service via deeply nested field names
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
multer vulnerable to Denial of Service via deeply nested field names
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
- Record
CVE-2026-5079- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2026-36726
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
- Record
EUVD-2026-36726- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-72gw-mp4g-v24j
Multer vulnerable to Denial of Service via deeply nested field names
Impact
Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches
Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.
Workarounds
Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
- Record
GHSA-72gw-mp4g-v24j- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
- Record
CVE-2026-5079- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
multer vulnerable to Denial of Service via deeply nested field names
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.
Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
- Record
CVE-2026-5079- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-72gw-mp4g-v24j
Multer vulnerable to Denial of Service via deeply nested field names
Impact
Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches
Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.
Workarounds
Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
- Record
GHSA-72gw-mp4g-v24j- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVCLSA-2026-1784077507 No score
TuxCare security update for multer (1 CVE)
TuxCare rebuilt multer to address 1 CVE. Fixed in 1.4.5-lts.1-tuxcare.5.
- Record
CLSA-2026-1784077507- Updated
- 2026-11-02
OSVCLSA-2026-1786358483 No score
TuxCare security update for multer (2 CVEs)
TuxCare rebuilt multer to address 2 CVEs. Fixed in 1.4.5-lts.2-tuxcare.4.
- Record
CLSA-2026-1786358483- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-5079 No score
CVE-2026-5079 in multer - Patched by Root
Root has patched CVE-2026-5079 in the multer package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-5079- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
multernpm |
1.0.0 up to 2.2.0 | 2.2.0 |
multernpm |
3.0.0-alpha.1 up to 3.0.0-alpha.2 | 3.0.0-alpha.2 |
multerTuxCare:npm |
1.4.5-lts.1-tuxcare.0 up to 1.4.5-lts.1-tuxcare.5, plus listed versions 1.4.5-lts.11.4.5-lts.1-tuxcare.11.4.5-lts.1-tuxcare.21.4.5-lts.1-tuxcare.31.4.5-lts.1-tuxcare.4 |
1.4.5-lts.1-tuxcare.5 |
multerTuxCare:npm From an advisory covering 2 CVEs |
1.4.5-lts.2-tuxcare.0 up to 1.4.5-lts.2-tuxcare.4, plus listed versions 1.4.5-lts.21.4.5-lts.2-tuxcare.11.4.5-lts.2-tuxcare.21.4.5-lts.2-tuxcare.3 |
1.4.5-lts.2-tuxcare.4 |
multerRoot:npm |
before 1.4.4-lts.1-aikido.3 | 1.4.4-lts.1-aikido.31.4.5-lts.2-aikido.91.4.4-lts.1-aikido.41.4.2-aikido.11.4.5-lts.1-aikido.21.4.5-lts.1-aikido.32.0.2-aikido.52.0.2-aikido.62.1.1-aikido.32.1.1-aikido.11.4.4-lts.1-aikido.11.4.4-aikido.41.4.5-lts.1-aikido.12.1.1-aikido.21.4.4-lts.1-aikido.21.4.4-aikido.51.4.5-lts.2-aikido.61.4.4-aikido.61.4.2-aikido.21.4.5-lts.2-aikido.71.4.5-lts.2-aikido.82.1.1-aikido.42.0.2-aikido.72.2.0-aikido.12.2.0-aikido.2 |
@rootio/multerRoot:npm |
before 1.4.4-lts.1-root.io.3 | 1.4.4-lts.1-root.io.31.4.5-lts.2-root.io.91.4.4-lts.1-root.io.41.4.2-root.io.11.4.5-lts.1-root.io.21.4.5-lts.1-root.io.32.0.2-root.io.52.0.2-root.io.62.1.1-root.io.32.1.1-root.io.11.4.4-lts.1-root.io.11.4.4-root.io.41.4.5-lts.1-root.io.12.1.1-root.io.21.4.4-lts.1-root.io.21.4.4-root.io.51.4.5-lts.2-root.io.61.4.4-root.io.61.4.2-root.io.21.4.5-lts.2-root.io.71.4.5-lts.2-root.io.82.1.1-root.io.42.0.2-root.io.72.2.0-root.io.12.2.0-root.io.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-5079 is a high vulnerability (CVSS 7.5) in Expressjs Multer, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in multer 2.2.0.