Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 High-severity security fix in multer@2.1.1 just released! Patches CVE-2026-3520 — vulnerable to Denial of Service via uncontrolled recursion https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2
Post summary
A new security fix has been released for CVE‑2026‑3520, addressing a denial‑of‑service vulnerability caused by uncontrolled recursion in multer 2.1.1.
CVE-2026-3520 Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (D… https://www.cve.org/CVERecord?id=CVE-2026-3520
Post summary
The content introduces CVE-2026-3520 as a Denial of Service vulnerability in Multer versions older than 2.1.1, offering only basic description without PoC, exploitation details, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | expressjs | multer | - | node.js | - |