CVE-2026-82333: Express.js Multer DOS Vulnerability

CVE-2026-82333 Overview

CVE-2026-82333 is a denial-of-service vulnerability in multer, a widely used Node.js middleware for handling multipart/form-data requests. A remote attacker can send a small multipart request containing two specially crafted text field names to block the Node.js event loop. The first field uses a large numeric array index that allocates a maximum-length sparse array. A second field with a non-numeric key then forces a full-length iteration inside the append-field dependency. The result stalls the process, preventing it from servicing other requests. All versions of multer before 2.3.0 are affected.

Critical Impact
An unauthenticated remote attacker can freeze any Node.js service that accepts multipart form uploads through multer, producing a full application-level denial of service.

Affected Products

expressjs/multer all versions before 2.3.0
Node.js applications using Express with multer for file uploads
Downstream frameworks bundling vulnerable multer releases

Discovery Timeline

2026-08-28 - CVE-2026-82333 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82333

Vulnerability Analysis

The flaw is an uncontrolled resource consumption issue [CWE-400] in the field-name parsing path of multer. When multer parses a text field whose name looks like arr[N], it delegates population to the append-field dependency. That dependency interprets the numeric segment as an array index and allocates a JavaScript array whose length equals N + 1. JavaScript represents such arrays as sparse structures, so the initial allocation is cheap. The cost appears later, when a second field with a non-numeric key against the same parent object triggers a full-length iteration to convert the sparse array into an object-like structure. That iteration runs synchronously on the main thread.

Because Node.js is single-threaded, the synchronous walk over a maximum-length array blocks the event loop. Concurrent requests queue behind the stalled worker, and the service stops responding to health checks, HTTP requests, and timers.

Root Cause

The root cause is missing validation on numeric array indexes in field names before allocation and iteration. multer did not enforce an upper bound on the index derived from user-supplied field names, and append-field iterates the resulting sparse array in full when the shape changes. This combination turns a two-field request into a worst-case algorithmic operation on the event loop.

Attack Vector

Exploitation requires only network access to any endpoint that parses multipart/form-data through multer. The attacker submits a small POST body containing two text fields. The first uses a very large numeric index in its name to force the maximum-length sparse array allocation. The second uses a non-numeric key on the same parent to trigger the full-length iteration inside append-field. No authentication, user interaction, or file upload payload is required. A single request is sufficient to freeze the worker, and repeated requests across upstream workers produce sustained denial of service.

Detection Methods for CVE-2026-82333

Indicators of Compromise

Sudden, sustained event-loop lag on Node.js workers immediately after receiving multipart/form-data POST requests.
Multipart request bodies containing field names with unusually large numeric bracket indexes such as arr[999999999].
Application worker processes becoming unresponsive to liveness or readiness probes shortly after inbound uploads.
HTTP 502 or 504 spikes from upstream load balancers routed to Node.js services using multer.

Detection Strategies

Inspect WAF or reverse-proxy logs for multipart field names matching a pattern of name[<large-integer>] and alert when the integer exceeds a sane threshold.
Instrument Node.js processes with event-loop lag metrics and alert on sustained lag correlated with multipart/form-data requests.
Enumerate deployed services and flag any using multer at a version below 2.3.0 in software composition analysis output.

Monitoring Recommendations

Track request duration percentiles on multipart upload endpoints and alert on tail-latency regressions.
Log the Content-Type, body size, and field-name structure of rejected uploads for retrospective hunting.
Correlate application unresponsiveness with recent inbound multipart requests in the SIEM to identify probing.

How to Mitigate CVE-2026-82333

Immediate Actions Required

Upgrade multer to version 2.3.0 or later in every Node.js service that accepts multipart form data.
Set limits.fieldArrayIndexLimit in the multer configuration to the largest array index the application actually needs.
Enforce strict limits.fields, limits.fieldSize, and limits.fieldNameSize values to constrain field parsing cost.
Restrict multipart upload endpoints behind authentication and rate limiting where the business function allows.

Patch Information

multer2.3.0 introduces the opt-in fieldArrayIndexLimit option that rejects oversized numeric array indexes in field names before allocation occurs. Upgrade and configure the limit as documented in the GitHub Security Advisory GHSA-535w-7cp7-47q4 and the OpenJS Foundation Security Advisories.

Workarounds

Deploy a WAF or reverse-proxy rule that rejects multipart requests whose field names contain numeric bracket indexes above a defined ceiling.
Cap multipart request body size at the ingress tier to reduce the surface for probing attempts.
Move multipart upload handling to an isolated worker pool or separate service so a stalled parser does not affect core APIs.

bash

# Configuration example
npm install multer@^2.3.0

# Example multer initialization with the new limit
# const upload = multer({
#   limits: {
#     fieldArrayIndexLimit: 1000,
#     fields: 50,
#     fieldNameSize: 100,
#     fieldSize: 1024 * 100
#   }
# });