CVE-2026-77078

The record

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Affected packages

Related vulnerabilities

• CVE-2026-19534 undici's WebSocket client crashes the whole Node.js process during the opening handshake… CWE-248
• CVE-2026-61666 websocket-driver is a WebSocket protocol handler with pluggable I/O. CWE-248
• CVE-2026-73418 NextAuth.js provides authentication for Next.js. CWE-248
• CVE-2026-73088 Browserslist is a configuration tool for sharing target browsers and Node.js versions… CWE-248
• CVE-2026-13697 undici's cache interceptor mishandles malformed Cache-Control private directives. CWE-248
• CVE-2026-47219 find-my-way is a framework-independent HTTP router that internally uses a Radix Tree and… CWE-248
• CVE-2026-50328 Uncaught exception in Windows Server Update Service allows an unauthorized attacker to… CWE-248
• CVE-2026-59875 node-tar is a tar archive manipulation library for Node.js. CWE-248