Listen to this Post
Technical Overview
multer is a widely-used middleware for Node.js applications to handle `multipart/form-data` requests, commonly used for file uploads. This vulnerability resides in how multer, via its `append-field` dependency, parses bracket notation in field names.
An attacker can craft a malicious multipart HTTP request containing two specific text fields. The first field uses an oversized numeric array index in its name, such as items
</code>. This forces the parser to allocate a maximum-length sparse array in memory. A subsequent field with a non-numeric key on the same base name, like <code>items[bash]</code>, then triggers a conversion of that sparse array into an object. This conversion process synchronously iterates over the entire length of the allocated array, consuming excessive CPU and blocking the Node.js event loop. Because Node.js is single-threaded, a blocked event loop prevents the application from handling any other incoming requests, resulting in a complete Denial of Service. A single crafted HTTP request is sufficient to trigger this condition, and it affects all versions of multer prior to 2.3.0. This vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and has a CVSS score of 7.5 (High). The issue is addressed in multer version 2.3.0, which introduces an opt-in configuration option, <code>limits.fieldArrayIndexLimit</code>. This allows developers to set a maximum allowable numeric index for array fields, rejecting requests that exceed this limit. <h2 style="color: blue;">DailyCVE Form</h2> Platform: Node.js Version: < 2.3.0 Vulnerability: DoS (Resource Exhaustion) Severity: High (CVSS 7.5) Date: 2026-08-28 <h2 style="color: blue;">Prediction: Patched in 2.3.0</h2> <h2 style="color: blue;">What Undercode Say</h2> The vulnerability is triggered by a crafted multipart request with two fields: 1. A field with an oversized array index (e.g., <code>items[bash]</code>). 2. A field with a non-numeric key on the same base (e.g., <code>items[bash]</code>). This causes a synchronous full-length iteration of a sparse array, blocking the Node.js event loop. <h2 style="color: blue;">Analytics & Detection</h2> To identify potentially vulnerable configurations, check the `multer` version in your `package.json` or <code>package-lock.json</code>: [bash] Check installed multer version npm list multer Search for multer in package-lock.json grep -A 2 '"multer"' package-lock.json
Exploit: (Educational Purposes!)
A proof-of-concept request can be constructed using `curl`:
curl -X POST http://target-application.com/upload \ -F "items[bash]=value1" \ -F "items[bash]=value2"
Sending this request to an unpatched server will cause the Node.js event loop to block, making the application unresponsive.
Protection
Upgrade: Immediately update the `multer` dependency to version 2.3.0 or later.
Configure: After upgrading, set the `limits.fieldArrayIndexLimit` option to the maximum array index your application legitimately requires.
const multer = require('multer');
const upload = multer({
limits: {
fieldArrayIndexLimit: 100 // Set to a reasonable limit
}
});
Validation: Implement application-level validation to reject or sanitize multipart field names that contain array indices larger than your specified limit.
Impact
Service Disruption: A single crafted request can cause a complete Denial of Service, making the application unresponsive to all users.
Remote Exploitation: The vulnerability is remotely triggerable without authentication.
Widespread Exposure: multer is a common middleware in the Node.js ecosystem, affecting a large number of web applications that handle file uploads or form data.
No Workarounds: There are no effective workarounds other than upgrading to the patched version.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
