GHSA-72gw-mp4g-v24j
High · 7.5CVSS
7.5
EPSS
—
Published
Jun 17, 2026
CISA due date
—
The record
Multer vulnerable to Denial of Service via deeply nested field names
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | multer | 1.0.0 | 2.2.0 |
| npm | multer | 3.0.0-alpha.1 | 3.0.0-alpha.2 |
Related vulnerabilities
- CVE-2026-5079 Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial… Same vulnerability
- GHSA-3p4h-7m6x-2hcm Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads Also affects multer
- CVE-2026-5038 Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a… Also affects multer
- GHSA-5528-5vmv-3xc2 Multer Vulnerable to Denial of Service via Uncontrolled Recursion Also affects multer
- CVE-2026-3520 Multer is a node.js middleware for handling `multipart/form-data`. Also affects multer
- GHSA-xf7r-hgr6-v32p Multer vulnerable to Denial of Service via incomplete cleanup Also affects multer
- GHSA-v52c-386h-88mc Multer vulnerable to Denial of Service via resource exhaustion Also affects multer
- CVE-2026-3304 Multer is a node.js middleware for handling `multipart/form-data`. Also affects multer