CVE-2026-3520

What it actually does

Multer versions prior to 2.1.1 can mishandle malformed multipart/form-data requests in a way that triggers excessive recursion or parsing depth, potentially resulting in a stack overflow. Because the attack is network-accessible, low-complexity, and requires no authentication or user interaction, an exposed Node.js/Express application using vulnerable Multer middleware may crash or become unable to process requests. The impact is limited to availability; the vulnerability does not indicate confidentiality or integrity compromise by itself.

Why it matters to the business

Public-facing applications that accept file uploads or multipart form submissions may be taken offline by unauthenticated malformed requests, causing service disruption, failed customer transactions, degraded API availability, and increased operational load from restarts or scaling events. The CVSS availability impact is high, but current EPSS is low and there is no CISA KEV listing or known ransomware association, so prioritization should be based on exposure of upload endpoints and criticality of affected services.

How an attack unfolds

An attacker first identifies a Node.js/Express application endpoint that accepts multipart/form-data, such as file upload, profile update, import, attachment, or form submission functionality. If that endpoint is processed by a vulnerable Multer version before 2.1.1, the attacker sends specially malformed multipart requests designed to exercise the parser path that can overflow the call stack. Successful exploitation may cause the Node.js process to terminate, hang, or repeatedly fail under process-manager restarts. Repeated requests can sustain a denial of service against the affected route or the entire application instance, depending on deployment architecture and error handling.

How to fix it

Upgrade Multer to version 2.1.1 or later wherever it is used directly or transitively. Because no workaround is identified, patching is the primary remediation. Review package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, container images, and vendored dependencies to ensure vulnerable Multer versions are not still present. Rebuild and redeploy applications after dependency updates. Where immediate patching is not possible, reduce exposure by restricting access to multipart upload endpoints, enforcing request size limits at reverse proxies and application gateways, rate-limiting upload routes, and using process supervision to restart crashed workers; these mitigations reduce impact but should not be treated as a fix.

How to confirm the fix worked

Confirm dependency resolution shows Multer 2.1.1 or later in every deployed application artifact, not only in source manifests. Use package manager inspection such as `npm ls multer`, `yarn why multer`, or equivalent SBOM/container scans. Verify deployed images and serverless bundles were rebuilt after the upgrade. Exercise multipart upload functionality with normal test cases to confirm business functionality still works. Confirm edge controls enforce maximum body size, multipart limits, and rate limits where applicable. If safe testing is authorized, validate that malformed multipart requests no longer crash the Node.js process in a non-production environment.

Typical attack path

1. Identify internet-facing web applications or APIs with multipart/form-data upload or form submission endpoints.
2. Fingerprint the application behavior by sending benign multipart requests and observing responses, errors, or upload handling.
3. Send malformed multipart/form-data requests crafted to trigger vulnerable Multer parsing behavior.
4. Cause the Node.js process or request worker to crash, hang, or exhaust stack space.
5. Repeat requests across one or more instances to sustain application unavailability or amplify operational instability.

How to detect it

Investigate web server, reverse proxy, application, container, and process-manager logs for signs of malformed multipart/form-data requests followed by Node.js errors, process crashes, restarts, or 5xx response spikes. Relevant sources include NGINX/Apache/Envoy/Ingress logs, WAF logs, application logs, Node.js stderr/stdout, PM2/systemd logs, Kubernetes pod events, container runtime logs, and APM traces. Look for repeated POST requests to upload or form endpoints with `Content-Type: multipart/form-data`, unusual or missing multipart boundaries, abnormal request termination, elevated 400/413/500/502/503 responses, and stack overflow messages such as `RangeError: Maximum call stack size exceeded`. Correlate these events with process exits, pod restarts, crash loops, or sudden availability drops. There are no public threat actors or known exploited-in-the-wild campaigns associated with this vulnerability in the provided data, so detection should focus on behavior rather than actor-specific infrastructure.

• Content-Type: multipart/form-data
• RangeError: Maximum call stack size exceeded
• Maximum call stack size exceeded
• PM2 App [
• exited with code
• systemd: Main process exited
• CrashLoopBackOff
• Back-off restarting failed container
• 502 Bad Gateway
• 503 Service Unavailable
• multipart: NextPart: EOF
• unexpected end of form
• Malformed part header
• boundary=

What your security team should do

• Inventory all Node.js/Express applications and APIs that use Multer, especially internet-facing upload or multipart form endpoints.
• Prioritize upgrading exposed and business-critical services to Multer 2.1.1 or later.
• Search lockfiles, SBOMs, container images, and CI dependency reports for Multer versions below 2.1.1.
• Apply request body size limits, upload field/file count limits, and rate limits on multipart endpoints as defense-in-depth.
• Increase monitoring for Node.js crashes, 5xx spikes, container restarts, and repeated malformed multipart requests until patching is complete.
• Ensure process managers and orchestration platforms restart failed workers, while recognizing that automatic restarts do not eliminate the vulnerability.
• Add regression tests for malformed multipart requests around upload endpoints after upgrading.