Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-82333— multer vulnerable to Denial of Service via oversized array index in field names

Quick assessment

Affected
multer multer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： Multer 是用于在 Node.js 中处理 multipart/form-data 请求的中间件。 一个包含两个特制文本字段名称的小型 multipart 请求，会使 Multer 的字段解析器同步遍历一个最大长度的稀疏数组，从而阻塞事件循环，导致进程无法处理其他请求。具体来说，第一个字段中包含一个较大的数字数组索引会分配一个最大长度的稀疏数组，随后第二个字段使用非数字键名，会在 依赖项中触发对整个数组的全长遍历。所有 2.3.0 之前的版本均受此影响，且该漏洞可被远程触发，导致拒

CVSS 7.5 · High

Possible ATT&CK Techniques 1 AI

T1027 · Obfuscated Files or Information
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-82333

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
multer vulnerable to Denial of Service via oversized array index in field names
Source: CVE Program / CVE List V5
Vulnerability Description
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
multer multer 0 ~ 2.3.0 -

II. Public POCs for CVE-2026-82333

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-82333

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-82333 (1)

Same Patch Batch · multer · 2026-08-28 · 4 CVEs total

CVE-2026-77078 7.5 HIGH multer vulnerable to Denial of Service via crafted multipart field names
CVE-2026-77037 7.5 HIGH multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
CVE-2026-77063 3.7 LOW multer vulnerable to file size limit bypass via async fileFilter race condition

IV. Related Vulnerabilities

Same product: multer
Same vendor: multer
Same weakness: CWE-400

V. Comments for CVE-2026-82333

No comments yet

Leave a comment