CVE-2026-77078 Overview
CVE-2026-77078 is a denial-of-service vulnerability in multer, the Node.js middleware for handling multipart/form-data requests. A remote attacker can send a small multipart request containing two crafted text field names that trigger an uncaught RangeError: Invalid array length inside multer's append-field dependency. The exception is not caught by multer and terminates the Node.js process. All versions before 2.3.0 are affected. The issue is tracked as CWE-248: Uncaught Exception and is fixed in multer 2.3.0.
Critical Impact
Unauthenticated attackers can crash any Node.js service that uses vulnerable multer versions by sending a single small HTTP request.
Affected Products
- expressjs/multer all versions prior to 2.3.0
- Node.js applications using Express with multer for file upload handling
- Downstream frameworks and services bundling vulnerable multer releases
Discovery Timeline
- 2026-08-28 - CVE-2026-77078 published to NVD
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77078
Vulnerability Analysis
Multer parses multipart form fields and forwards each field name and value to the append-field dependency, which builds a nested JavaScript object based on bracket notation in the field name. When a field name contains a numeric bracket index, append-field allocates an array sized to that index. Supplying a numeric index at or near JavaScript's maximum array length causes the runtime to allocate a maximum-length sparse array.
A second field then attempts to push a value past that boundary. This operation throws a synchronous RangeError: Invalid array length from within the dependency. Multer does not wrap the call in a try/catch block, so the exception propagates as an uncaught exception and terminates the Node.js process. The result is a remotely triggerable crash of the entire application server.
Root Cause
The root cause is missing exception handling around a third-party parsing routine that performs unbounded array allocation based on attacker-controlled input. The primary weakness is CWE-248: Uncaught Exception, compounded by lack of input validation on multipart field names before they are passed to append-field.
Attack Vector
Exploitation requires no authentication, no user interaction, and no prior access. An attacker sends a single small multipart/form-data HTTP request to any endpoint handled by vulnerable multer middleware. The first field name embeds a very large numeric array index in bracket notation, forcing a maximum-length sparse array allocation. A second field name attempts an operation that overflows that length. The process crashes immediately, denying service to all users. Refer to the GitHub Security Advisory GHSA-wc9g-mqfw-jrwm for the technical write-up.
Detection Methods for CVE-2026-77078
Indicators of Compromise
- Node.js process termination logs showing RangeError: Invalid array length originating in the append-field module
- Repeated multipart/form-data requests from a single source immediately followed by application crash or restart events
- Sudden process supervisor restarts (pm2, systemd, container orchestrator) correlated with inbound upload traffic
Detection Strategies
- Inventory Node.js applications and identify any that declare multer at a version below 2.3.0 in package.json or package-lock.json
- Inspect reverse-proxy and application logs for multipart requests whose field names contain large numeric bracket indices
- Alert on unhandled exception events emitted by Node.js runtimes hosting Express services
Monitoring Recommendations
- Forward Node.js stderr and process-exit events to a centralized logging pipeline for correlation with request telemetry
- Track application availability metrics and restart counts to surface DoS patterns early
- Monitor WAF and API gateway telemetry for unusually structured multipart field names
How to Mitigate CVE-2026-77078
Immediate Actions Required
- Upgrade multer to version 2.3.0 or later in all Node.js applications
- Rebuild and redeploy container images and serverless functions that bundle vulnerable multer releases
- Audit transitive dependencies with npm ls multer to catch indirect usage
Patch Information
The issue is fixed in multer 2.3.0. Update the dependency using npm install multer@^2.3.0 or the equivalent for yarn and pnpm. Consult the GitHub Security Advisory GHSA-wc9g-mqfw-jrwm and the OpenJS Foundation Security Advisories for release notes and additional guidance.
Workarounds
- Place a Web Application Firewall (WAF) rule in front of upload endpoints to reject multipart field names containing large numeric bracket indices
- Enforce request size and field-count limits at the reverse proxy to reduce exposure until patching completes
- Restrict multipart upload routes to authenticated users where feasible to shrink the unauthenticated attack surface
# Upgrade multer to the patched release
npm install multer@^2.3.0
npm ls multer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
