CVE-2026-3520: Multer Node.js Middleware DoS Vulnerability

CVE-2026-3520 Overview

CVE-2026-3520 is a Denial of Service (DoS) vulnerability in Multer, a popular Node.js middleware used for handling multipart/form-data in web applications. The vulnerability exists in versions prior to 2.1.1 and allows attackers to trigger a stack overflow by sending specially crafted malformed requests to vulnerable endpoints.

Multer is widely used in Express.js applications for file upload functionality, making this vulnerability particularly concerning for web applications that accept user-uploaded content. An attacker can exploit this flaw to crash the Node.js process, resulting in service disruption for legitimate users.

Critical Impact

Unauthenticated remote attackers can cause complete application unavailability by sending malformed multipart requests, potentially leading to service outages for Node.js applications using vulnerable Multer versions.

Affected Products

• Multer versions prior to 2.1.1
• Node.js applications using vulnerable Multer middleware
• Express.js applications with multipart/form-data file upload functionality

Discovery Timeline

• 2026-03-04 - CVE-2026-3520 published to NVD
• 2026-03-04 - Last updated in NVD database

Technical Details for CVE-2026-3520

Vulnerability Analysis

This vulnerability is classified under CWE-674 (Uncontrolled Recursion), indicating that the root cause involves recursive function calls that lack proper depth controls. When Multer processes multipart/form-data requests, certain malformed input can trigger excessive recursion in the parsing logic, ultimately exhausting the call stack and crashing the Node.js process.

The network-accessible nature of this vulnerability means that any exposed endpoint using Multer for file handling becomes a potential target. No authentication or user interaction is required to exploit this flaw, making it particularly dangerous for internet-facing applications.

Root Cause

The vulnerability stems from uncontrolled recursion during the parsing of malformed multipart/form-data requests. When processing certain malicious payloads, the Multer middleware enters a recursive call pattern without adequate depth checking or termination conditions. This leads to stack exhaustion as the recursion depth exceeds the JavaScript engine's call stack limits, resulting in a fatal error that crashes the application.

Attack Vector

The attack is network-based and requires no authentication or special privileges. An attacker can exploit this vulnerability by:

1. Identifying an endpoint that uses Multer for handling file uploads
2. Crafting a malformed multipart/form-data request designed to trigger the recursive parsing behavior
3. Sending the malicious request to the target application
4. The vulnerable Multer middleware attempts to parse the request, entering uncontrolled recursion
5. The Node.js process crashes due to stack overflow, causing a denial of service

The attack can be repeated to maintain service disruption, as each restart of the application leaves it vulnerable to the same exploit until patched.

Detection Methods for CVE-2026-3520

Indicators of Compromise

• Unusual increase in malformed multipart/form-data requests to file upload endpoints
• Node.js application crashes with "RangeError: Maximum call stack size exceeded" errors
• Multiple rapid restarts of Node.js processes handling file uploads
• Abnormal request patterns targeting endpoints with Multer middleware

Detection Strategies

• Monitor application logs for stack overflow exceptions and process crashes related to multipart parsing
• Implement request rate limiting and anomaly detection on file upload endpoints
• Deploy Web Application Firewall (WAF) rules to detect and block malformed multipart requests
• Use application performance monitoring (APM) tools to track unusual memory and CPU patterns during request processing

Monitoring Recommendations

• Configure alerting for Node.js process crashes and automatic restarts
• Implement logging for all multipart/form-data parsing errors and exceptions
• Monitor network traffic for unusually large or malformed Content-Type headers
• Set up dashboards to track file upload endpoint availability and response times

How to Mitigate CVE-2026-3520

Immediate Actions Required

• Upgrade Multer to version 2.1.1 or later immediately
• Review all Node.js applications using Multer middleware to identify vulnerable instances
• Implement request size limits and input validation at the network edge
• Consider temporarily disabling file upload functionality if patching is delayed
• Deploy WAF rules to filter potentially malicious multipart requests

Patch Information

The Multer development team has released version 2.1.1 which addresses this vulnerability. The fix is available in the GitHub commit. Users should update their package.json dependencies and run npm update multer or yarn upgrade multer to apply the patch.

For detailed information about this security issue, refer to the GitHub Security Advisory GHSA-5528-5vmv-3xc2 and the OpenJS Foundation Security Advisories.

Workarounds

• No official workarounds are available according to the security advisory
• Implement strict request size limits and rate limiting as a defense-in-depth measure
• Consider using a reverse proxy to filter malformed requests before they reach the application
• Deploy network-level protections to limit exposure of vulnerable endpoints
• Monitor and auto-restart crashed processes while working toward patching

# Update Multer to patched version
npm update multer@2.1.1

# Or using yarn
yarn upgrade multer@2.1.1

# Verify installed version
npm list multer