AIKIDO-2026-23196
multer is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
multerTL;DR
Multer converts bracket-notation multipart field names into arrays. A field name containing an extremely large numeric index forces the append-field dependency to allocate a maximum-length sparse array, and a later field with a non-numeric key under the same base causes the code to traverse the entire array length to convert it into an object. This synchronous work consumes CPU and blocks the event loop, leaving the process unable to serve other requests, and a single request suffices to trigger it. The fix bounds numeric array indexes and adds a configurable fieldArrayIndexLimit.
Who does this affect?
You are affected if your application uses multer to parse multipart/form-data field names from untrusted input.
Background info
multer is vulnerable to Denial of Service (DoS) in versions 0.0.1 - 2.2.0.
How to fix this
Upgrade the multer library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.