Multer CVE-2026-5079: Brief Summary of a Single Request DoS via Deeply Nested Field Names

Introduction

A single HTTP request containing a carefully crafted multipart form field name can bring down a Node.js server running multer, the most widely used middleware for handling file uploads in the Express.js ecosystem. CVE-2026-5079, scored at CVSS 7.5 (High), affects every multer deployment from version 1.0.0 through 2.1.1, which translates to a blast radius spanning 17.5 million weekly npm downloads and over 6,400 dependent packages.

The vulnerability originates not in multer itself but in its transitive dependency append-field, which implements W3C HTML JSON forms bracket notation parsing with no upper bound on nesting depth. This is the seventh DoS vulnerability disclosed in multer since mid 2025, a pattern that warrants attention from any team running Node.js services that accept multipart form data.

Technical Information

Vulnerability Classification

CVE-2026-5079 falls under CWE-400: Uncontrolled Resource Consumption. The CVSS v3 vector reflects a network accessible attack with low complexity, requiring no privileges or user interaction, producing high impact on availability with no effect on confidentiality or integrity.

The Role of append-field

Multer is built on top of the Busboy streaming parser for maximum efficiency when handling multipart/form-data requests. When Busboy emits parsed field events, multer uses the append-field package to construct a JavaScript object from the field names. The append-field package is described as a "W3C HTML JSON forms spec compliant field appender" and implements bracket notation parsing. For example, a field named user[address][city] is transformed into the nested object { user: { address: { city: "value" } } }.

The critical design flaw is that append-field places no limit on nesting depth. It will faithfully attempt to construct an object tree of arbitrary depth based on whatever bracket notation it receives.

Attack Flow

The exploitation path is straightforward and requires no special tooling:

1. The attacker constructs an HTTP POST request with Content-Type: multipart/form-data.
2. Within the multipart body, the attacker includes one or more field names containing extremely deep bracket notation nesting, for example a[b][c][d]...[z] repeated hundreds or thousands of times.
3. The target server receives the request and Busboy begins parsing the multipart stream, emitting field events as it encounters each part.
4. Multer receives the field events and delegates to append-field to construct the corresponding JavaScript object.
5. append-field recursively creates nested objects matching the full depth of the bracket notation. This recursive allocation consumes significant CPU cycles and memory.
6. With sufficient nesting depth, the server's event loop is blocked and memory is exhausted, resulting in denial of service.

The key properties that make this vulnerability particularly concerning:

• Single request exploitation: One crafted HTTP POST is sufficient. There is no need for sustained traffic or amplification.
• No authentication required: Any client that can reach a multer handled endpoint can trigger the vulnerability.
• No application specific knowledge needed: The attacker does not need to know anything about the target application's field schema or internal structure.

Root Cause: Unbounded Recursion in a Transitive Dependency

This vulnerability highlights a recurring challenge in the Node.js ecosystem: security critical behavior buried in transitive dependencies. The append-field package is not something most developers consciously choose or configure. It is pulled in automatically as a dependency of multer, and its behavior (unbounded recursive object construction) is invisible to application developers until it becomes an attack vector.

The fix in multer 2.2.0 and 3.0.0-alpha.2 introduces a new limits.fieldNestingDepth configuration option that caps how deep the bracket notation parsing will go. This moves the enforcement boundary into multer itself rather than relying on append-field to self limit.

Affected Systems and Versions

The vulnerability spans the entire production history of multer from its 1.0.0 release onward. Any Node.js application using multer to handle multipart form uploads is affected unless it has been upgraded to one of the patched versions.

The partial workaround of setting limits.fields to a low value can reduce exposure but does not fully mitigate the issue, because even a single deeply nested field name can trigger significant resource consumption.

Organizations should also audit their dependency trees for indirect usage of multer. With 6,473 dependent packages on npm, multer may be present in applications through frameworks, boilerplate generators, or other middleware libraries that bundle it.

Vendor Security History

Multer's security track record over the past year reveals a pattern of recurring DoS vulnerabilities, each exploiting a different weakness in multipart handling:

The OpenJS Foundation, which hosts multer and Express.js, became a CVE Numbering Authority in June 2025 and has been responsive in issuing patches and coordinated disclosures. The advisory for CVE-2026-5079 was published by UlisesGascon, a contributor to the expressjs organization's security efforts.

However, the diversity of root causes across these seven CVEs (unhandled exceptions, memory leaks, incomplete cleanup, unbounded recursion) suggests that multipart/form-data parsing presents inherent complexity that individual fixes cannot fully address. Teams relying on multer should plan for ongoing patching cycles and implement defense in depth measures at the infrastructure layer: rate limiting multipart POST requests at the reverse proxy, enforcing maximum request body sizes, and monitoring for anomalous field name patterns.

References

• GitHub Advisory: multer vulnerable to Denial of Service via deeply nested field names (GHSA-72gw-mp4g-v24j)
• OpenJS Foundation CNA Security Advisories
• multer on npm
• expressjs/multer on GitHub
• LinusU/node-append-field on GitHub
• CVE-2026-3520 Detail (NVD)
• CVE-2026-3304: Multer Node.js Middleware DoS (SentinelOne)
• CVE-2026-3520: Multer Vulnerable to Denial of Service (EndorLabs)
• CVE-2026-2359 (Aqua Security)
• CVE-2026-3520 (Red Hat)
• OpenJS Security Checkpoint: 2025 So Far
• May 2025 Security Releases (Express.js)
• Multer DoS Vulnerability CVE-2025-7338 (ZeroPath)
• GHSA-xf7r-hgr6-v32p: Multer vulnerable to DoS via incomplete cleanup
• GHSA-g5hg-p3ph-g8qg: Multer vulnerable to DoS via unhandled exception