Denial of Service in multer via Crafted Multipart Field Names

The npm package 'multer', a common middleware for handling 'multipart/form-data' in Node.js applications, contains a high-severity vulnerability tracked as CVE-2026-77078. The issue stems from an improper handling of multipart field names within the library's parsing logic. By providing two specially crafted text field names in a single request, a remote, unauthenticated attacker can force an uncaught 'RangeError: Invalid array length' during the parsing phase. Because this error occurs outside of the application's defined error handling middleware or global try-catch blocks, it results in the immediate termination of the Node.js process. This vulnerability affects all applications utilizing multer versions prior to 2.3.0 for processing multipart uploads, posing a significant risk of service disruption for web applications.

Impact

Successful exploitation leads to an immediate crash of the Node.js process, causing a complete denial of service for the affected application. Given the ubiquity of multer in the Node.js ecosystem, any web service accepting file uploads or form data is potentially vulnerable. There are no known workarounds, necessitating an immediate upgrade to the patched version.

Recommendation

Update the 'multer' dependency in all Node.js projects to version 2.3.0 or later to include the patch for CVE-2026-77078.