DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77078: CVE-2026-77078: Remote Denial of Service in Multer Middleware via Array Suffix Handling

#security #cve #cybersecurity

CVE-2026-77078: Remote Denial of Service in Multer Middleware via Array Suffix Handling

Vulnerability ID: CVE-2026-77078
CVSS Score: 7.5
Published: 2026-09-08

CVE-2026-77078 is a critical denial of service vulnerability in the multer Node.js package, allowing unauthenticated remote attackers to crash the runtime process using a single crafted multipart/form-data HTTP payload.

TL;DR

Unauthenticated remote attackers can crash Express.js applications using multer < 2.3.0 by sending crafted multipart requests that trigger an unhandled RangeError in the V8 engine.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-248 (Uncaught Exception)
  • Attack Vector: Network (AV:N)
  • CVSS Severity: 7.5 (High)
  • EPSS Score: 0.00291 (Percentile: 21.34%)
  • Impact Type: Denial of Service (DoS) via Process Termination
  • Exploit Status: Proof of Concept (PoC) Available
  • CISA KEV Status: Not Listed

Affected Systems

  • Node.js applications running multer versions prior to 2.3.0
  • multer: < 2.3.0 (Fixed in: 2.3.0)

Code Analysis

Commit: 87a584e

fix: reject invalid field names instead of crashing on append-field errors

@@ -31,7 +31,11 @@ function makeMiddleware (setup) {\n-\t\t\tappendField(req.body, fieldname, value)\n+\t\t\ttry {\n+\t\t\t\tappendField(req.body, fieldname, value)\n+\t\t\t} catch {\n+\t\t\t\treturn abortWithCode('INVALID_FIELD_NAME', fieldname)\n+\t\t\t}
Enter fullscreen mode Exit fullscreen mode

Exploit Details

Mitigation Strategies

  • Upgrade multer dependency to version 2.3.0 or higher.
  • Implement Web Application Firewall (WAF) regex patterns to filter out excessively large bracketed array indices.
  • Configure robust process monitoring toolings like PM2 or systemd to automatically recover from process terminations.

Remediation Steps:

  1. Run npm install multer@2.3.0 inside your project root.
  2. Verify the updated version in package.json.
  3. Implement error routing middleware to gracefully capture and handle the new INVALID_FIELD_NAME error.
  4. Deploy WAF rules to drop incoming multipart payloads with array indices exceeding 4,000,000,000.

References

Read the full report for CVE-2026-77078 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)