CVE-2026-62966

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in src/WebRequest.cpp frees _itemBuffer and sets it to NULL when BOUNDARY_OR_DATA matches the closing boundary of a file part, before confirming the following terminator, while leaving _itemIsFile true. If the next byte is neither the final closing dashes nor a clean CRLF, the DASH3_OR_RETURN2 or EXPECT_FEED2 rewind branch re-injects provisionally consumed bytes through itemWriteByte. Because _itemIsFile remains true, _itemBuffer[_itemBufferIndex++] writes through a null pointer. On ESP32 this causes a StoreProhibited exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in src/WebRequest.cpp frees _itemBuffer and sets it to NULL when BOUNDARY_OR_DATA matches the closing boundary of a file part, before confirming the following terminator, while leaving _itemIsFile true. If the next byte is neither the final closing dashes nor a clean CRLF, the DASH3_OR_RETURN2 or EXPECT_FEED2 rewind branch re-injects provisionally consumed bytes through itemWriteByte. Because _itemIsFile remains true, _itemBuffer[_itemBufferIndex++] writes through a null pointer. On ESP32 this causes a StoreProhibited exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in src/WebRequest.cpp frees _itemBuffer and sets it to NULL when BOUNDARY_OR_DATA matches the closing boundary of a file part, before confirming the following terminator, while leaving _itemIsFile true. If the next byte is neither the final closing dashes nor a clean CRLF, the DASH3_OR_RETURN2 or EXPECT_FEED2 rewind branch re-injects provisionally consumed bytes through itemWriteByte. Because _itemIsFile remains true, _itemBuffer[_itemBufferIndex++] writes through a null pointer. On ESP32 this causes a StoreProhibited exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in src/WebRequest.cpp frees _itemBuffer and sets it to NULL when BOUNDARY_OR_DATA matches the closing boundary of a file part, before confirming the following terminator, while leaving _itemIsFile true. If the next byte is neither the final closing dashes nor a clean CRLF, the DASH3_OR_RETURN2 or EXPECT_FEED2 rewind branch re-injects provisionally consumed bytes through itemWriteByte. Because _itemIsFile remains true, _itemBuffer[_itemBufferIndex++] writes through a null pointer. On ESP32 this causes a StoreProhibited exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.