CVE-2026-5079 Details
Description
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires. Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
A denial-of-service vulnerability has been identified in Multer, a middleware for handling multipart/form-data. This issue affects Multer versions 1.0.0 prior to 2.2.0, as well as versions 3.0.0-alpha.1 prior to 3.0.0-alpha.2. The vulnerability arises from the 'append-field' dependency, which parses bracket notation in field names without any limit on nesting depth. This allows an attacker to create deeply nested object structures that consume excessive CPU and memory. Exploitation can be achieved with a single HTTP request containing a crafted multipart body.
Users are advised to upgrade to Multer version 2.2.0 (for the 2.x line) or version 3.0.0-alpha.2 (for the 3.x prerelease). After upgrading, configure the 'limits.fieldNestingDepth' option to the minimum depth required by the application. Additionally, as a temporary workaround, 'limits.fields' can be set to a reasonable value to limit the number of fields an attacker can send per request, although this does not fully mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.openjsf.org/security-advisories.html | openjs | Vendor Advisory |
| https://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j | openjs | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | openjs |
Affected Products
| Product | Versions |
|---|---|
| expressjs multer | >= 1.0.0, < 2.2.0 3.0.0 alpha1 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | openjs |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 15, 2026 | New CVE Received | openjs |