CVE-2026-5079: multer vulnerable to Denial of Service via deeply nested field names

Synopsis

This is a denial-of-service vulnerability in the multer Node.js middleware, which handles multipart form data uploads. The flaw is reachable over the network with no authentication required: a single crafted HTTP request containing a multipart body with deeply nested bracket-notation field names forces the server to allocate deeply nested object structures, exhausting CPU and memory. Successful exploitation crashes or severely degrades the affected service. Patched-image rebuilds at multer 2.2.0 and 3.0.0-alpha.2 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the target service over the network; the vulnerable multipart parsing is triggered by a standard HTTP request sent to any exposed endpoint using multer.

• AuthenticationNot required

  No account or credential is needed; the malicious multipart request can be submitted by any unauthenticated HTTP client.

• Victim interactionNot required

  No user action is required; the attacker sends a single crafted request directly to the server without any social-engineering step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and condition-free; no race conditions, memory layout knowledge, or other environmental factors are needed to trigger the vulnerability.

Blast Radius

• Crashes or severely degrades the targeted Node.js service by exhausting available CPU and memory through deeply nested object allocation.
• A single HTTP request is sufficient to trigger the impact, making repeated or distributed attacks trivial.
• All endpoints in the application that use multer for multipart form parsing are exposed, not just dedicated file-upload routes.