CVE-2026-5079: Expressjs Multer DOS Vulnerability

CVE-2026-5079 Overview

CVE-2026-5079 is a denial of service vulnerability in multer, a widely-used Node.js middleware for handling multipart/form-data uploads in Express applications. The flaw affects multer versions 1.0.0 through 2.1.1, as well as the 3.0.0-alpha.1 prerelease. Attackers can submit a single HTTP request with crafted multipart field names that use bracket notation to force unbounded nested object allocation. The append-field dependency parses these field names with no cap on nesting depth, exhausting CPU and memory on the server. The vulnerability is tracked as [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
A single unauthenticated HTTP request can exhaust server CPU and memory, taking Node.js applications offline without requiring authentication or user interaction.

Affected Products

expressjs/multer versions 1.0.0 through 2.1.1
expressjs/multer version 3.0.0-alpha.1
Node.js applications depending on vulnerable multer releases via the append-field dependency

Discovery Timeline

2026-06-15 - CVE-2026-5079 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-5079

Vulnerability Analysis

The vulnerability resides in how multer processes multipart form field names through its append-field dependency. Multipart form data permits field names that use bracket notation such as a[b][c][d] to represent nested objects. The parser expands these bracketed paths into actual JavaScript object structures on the server. Because no maximum nesting depth is enforced, an attacker can submit field names with thousands of bracket levels.

Each additional level forces allocation of a new object and traversal through the existing structure. The compounded CPU and memory cost on a single request is sufficient to stall the event loop and degrade or halt the Node.js process. Multiple concurrent requests amplify the impact across the application tier.

Root Cause

The root cause is missing input validation on the depth of bracket-notation field names parsed by append-field. The library accepts arbitrarily deep field paths and constructs corresponding nested objects without bounding allocation. This is a classic uncontrolled resource consumption pattern in which untrusted input drives unbounded work on the server side.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends a multipart/form-data POST request to any endpoint handled by vulnerable multer middleware. The request body contains one or more field names constructed with deeply nested bracket notation, for example a field name composed of many repeated [x] segments. When multer parses the form, append-field recursively builds the nested object tree, consuming CPU cycles and heap memory until the process degrades or crashes. Refer to the GitHub Security Advisory GHSA-72gw-mp4g-v24j for the upstream technical description.

Detection Methods for CVE-2026-5079

Indicators of Compromise

Multipart form upload requests containing field names with unusually long sequences of bracket notation, such as repeated [x] segments.
Node.js worker processes exhibiting sustained high CPU usage and growing resident memory tied to multipart parsing.
Event loop lag, request timeouts, or process restarts coinciding with inbound multipart/form-data traffic.

Detection Strategies

Inspect WAF or reverse proxy logs for Content-Type: multipart/form-data requests where field name length or bracket count exceeds reasonable thresholds.
Instrument the application to log multipart field names and alert on nesting depth above a configured limit.
Correlate spikes in CPU, heap usage, and process.memoryUsage() metrics with upload endpoint traffic in APM dashboards.

Monitoring Recommendations

Track per-endpoint request latency percentiles for upload routes and alert on regression patterns.
Monitor Node.js event loop lag and garbage collection pause durations on services that accept multipart input.
Enable rate limiting and request size accounting at the edge, and review anomalies in request counts versus upstream CPU consumption.

How to Mitigate CVE-2026-5079

Immediate Actions Required

Upgrade multer to version 2.2.0 on the 2.x line or 3.0.0-alpha.2 on the 3.x prerelease line.
Configure the new limits.fieldNestingDepth option to the minimum depth your application actually requires.
Audit all Express routes that use multer middleware and confirm each instance applies the updated limits.

Patch Information

The maintainers released fixes in multer2.2.0 and 3.0.0-alpha.2. The patched versions introduce a new limits.fieldNestingDepth configuration option that caps how deeply bracket-notation field names are expanded. Set this value as low as the application allows. Full details are available in the GitHub Security Advisory GHSA-72gw-mp4g-v24j and the OpenJS Foundation Security Advisories.

Workarounds

Set limits.fields to a conservative value to reduce the number of fields an attacker can submit per request. This reduces but does not eliminate the risk.
Enforce a strict maximum request body size on the upstream reverse proxy or load balancer for multipart endpoints.
Apply edge-layer request inspection rules that reject multipart payloads containing field names with excessive bracket nesting.

bash

# Configuration example
npm install multer@2.2.0

# Apply minimum-required nesting depth in application code
# const upload = multer({ limits: { fieldNestingDepth: 1, fields: 100 } });