CVE-2026-62966— ESPAsyncWebServer multipart parser has null-pointer write

Quick assessment

Affected

ESP32Async ESPAsyncWebServer

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

ESPAsyncWebServer 是一个为 ESP32、ESP8266、RP2040 和 RP2350 平台提供的异步 HTTP 和 WebSocket 服务器库。在 3.11.2 版本之前，位于中的 multipart 解析器在检测到与文件部分的结束边界匹配时，会提前释放并将其置为 NULL，同时保持为 true，而尚未验证后续的终止符。如果下一个字节既不是最终的结束破折号，也不是干净的 CRLF（回车换行），则或的回退分支会通过重新注入此前临时消耗的字节。由于此时仍为 true，代码会尝试通过

CVSS 7.5 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

ESPAsyncWebServer multipart parser has null-pointer write

Source: CVE Program / CVE List V5

Vulnerability Description

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

空指针解引用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ESP32Async	ESPAsyncWebServer	< 3.11.2	-

II. Public POCs for CVE-2026-62966

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62966

请登录查看更多情报信息。

Other References for CVE-2026-62966 (3)

https://github.com/ESP32Async/ESPAsyncWebServer/tree/v3.11.2 x_refsource_MISC
https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-8m8p-vhxc-jmjw x_refsource_CONFIRM
https://github.com/ESP32Async/ESPAsyncWebServer/commit/4efbd35e597d91f01749f2d4a14bb78fba8ea02e x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62966

IV. Related Vulnerabilities

Same product: ESPAsyncWebServer

Same vendor: ESP32Async

Same weakness: CWE-476