AIKIDO-2026-334092

TL;DR

multer handles multipart/form-data and passes submitted field names to its append-field dependency, which expands bracket notation such as a[b][c] into nested objects. The parser applies no limit on nesting depth, so a single request with a field name containing tens of thousands of brackets forces allocation of deeply nested structures. This consumes excessive CPU and memory and can render the service unavailable without authentication. The fix adds a fieldNestingDepth limit option that rejects field names whose nesting exceeds the configured depth.