🚨High - Multer Multipart Form Data Denial of Service (CVE-2026-5079) A high-severity denial of service (DoS) vulnerability has been identified in multer, a popular Node.js middleware framework used for handling multipart/form-data. The flaw stems from an underlying dependency, append-field, which processes bracket notation in HTTP form field names without enforcing a structural restriction on nesting depth. An unauthenticated remote attacker can exploit this behavior by submitting a single, specially crafted HTTP multipart request containing deeply nested field names. This forces the server to allocate highly recursive object topologies, exhaustively consuming CPU cycles and system memory to trigger a service crash. 👉 Affected: multer versions 1.0.0 through 2.1.1, and 3.0.0-alpha.1 | Upgrade to patched versions 2.2.0 or 3.0.0-alpha.2 or later
Post summary
The advisory discloses a high‑severity DoS vulnerability in Multer caused by unchecked nesting depth in HTTP form fields and provides a patch recommendation to upgrade to newer, fixed versions.
