DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-82333: CVE-2026-82333: Remote Denial of Service via Sparse Array Manipulation in Multer

#security #cve #cybersecurity

CVE-2026-82333: Remote Denial of Service via Sparse Array Manipulation in Multer

Vulnerability ID: CVE-2026-82333
CVSS Score: 7.5
Published: 2026-09-08

A high-severity denial of service vulnerability in the Node.js middleware 'multer' allows unauthenticated remote attackers to exhaust CPU resources and freeze applications. By submitting small, specially crafted 'multipart/form-data' requests containing large array indices alongside conflicting parameter keys, attackers force synchronous execution loops over up to 4.2 billion elements within the underlying 'append-field' library.

TL;DR

Unauthenticated remote attackers can freeze Node.js web applications using multer by sending low-bandwidth multipart POST requests containing extremely large array indices, which blocks the single-threaded event loop via synchronous sparse-array conversion.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • EPSS Score: 0.00278 (20.04% percentile)
  • Exploit Status: poc
  • KEV Status: Not Listed
  • Impact: Denial of Service (Complete)

Affected Systems

  • Node.js applications running multer < 2.3.0
  • multer: < 2.3.0 (Fixed in: 2.3.0)

Code Analysis

Commit: 73c1759

Add fieldArrayIndexLimit limit to avoid sparse array DoS vulnerability

Exploit Details

Mitigation Strategies

  • Upgrade multer to version 2.3.0 or higher.
  • Explicitly configure limits.fieldArrayIndexLimit in all multer instances to a low integer value.
  • Implement robust API health and latency checks to automate container recycling when the event loop is blocked.

Remediation Steps:

  1. Run 'npm install multer@2.3.0' in the root directory of your project.
  2. Search the application codebase for occurrences of 'multer('.
  3. Update all instances of multer initialization to pass an options object with 'limits: { fieldArrayIndexLimit: 100 }' (or another low integer matching application logic).
  4. Add an Express error handling middleware to gracefully return a 400 response for 'LIMIT_FIELD_ARRAY_INDEX' errors.

References

Read the full report for CVE-2026-82333 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)