Multer CVE-2026-5079: Brief Summary of a Single Request DoS via Deeply Nested Field Names

Introduction

A single HTTP request containing a carefully crafted multipart form field name can bring down a Node.js server running multer, the most widely used middleware for handling file uploads in the Express.js ecosystem. CVE-2026-5079 is scored at CVSS 7.5 (High) and affects every multer deployment from version 1.0.0 through 2.1.1. That covers 17.5 million weekly npm downloads and over 6,400 dependent packages.

The bug sits in multer's transitive dependency append-field rather than in multer's own code. append-field implements W3C HTML JSON forms bracket notation parsing with no upper bound on nesting depth. This is the seventh DoS vulnerability disclosed in multer since mid-2025, and any team running Node.js services that accept multipart form data should take note of that pattern.

Technical Information

Vulnerability Classification

CVE-2026-5079 is classified as CWE-400: Uncontrolled Resource Consumption. The CVSS v3 vector describes a network-accessible attack with low complexity that requires no privileges or user interaction. The impact on availability is high, and there is no effect on confidentiality or integrity.

The Role of append-field

Multer is built on the Busboy streaming parser for efficient handling of multipart/form-data requests. When Busboy emits parsed field events, multer uses the append-field package to build a JavaScript object from the field names. The append-field package is described as a "W3C HTML JSON forms spec compliant field appender" and implements bracket notation parsing. For example, it turns a field named user[address][city] into the nested object { user: { address: { city: "value" } } }.

The design flaw is that append-field places no limit on nesting depth. It will try to build an object tree as deep as whatever bracket notation it receives.

Attack Flow

The exploitation path is straightforward and requires no special tooling:

1. The attacker constructs an HTTP POST request with Content-Type: multipart/form-data.
2. Within the multipart body, the attacker includes one or more field names containing extremely deep bracket notation nesting, for example a[b][c][d]...[z] repeated hundreds or thousands of times.
3. The target server receives the request and Busboy begins parsing the multipart stream, emitting field events as it encounters each part.
4. Multer receives the field events and delegates to append-field to construct the corresponding JavaScript object.
5. append-field recursively creates nested objects matching the full depth of the bracket notation. This recursive allocation consumes significant CPU cycles and memory.
6. With sufficient nesting depth, the server's event loop is blocked and memory is exhausted, resulting in denial of service.

Three properties make this vulnerability particularly concerning:

• One crafted HTTP POST is enough. The attack needs no sustained traffic or amplification.
• No authentication is required. Any client that can reach a multer-handled endpoint can trigger the vulnerability.
• The attacker does not need to know anything about the target application's field schema or internal structure.

Root Cause: Unbounded Recursion in a Transitive Dependency

Security-critical behavior buried in transitive dependencies is a recurring problem in the Node.js ecosystem, and this vulnerability is another case of it. Most developers never consciously choose or configure append-field. It comes in automatically as a dependency of multer, and its behavior (unbounded recursive object construction) stays invisible to application developers until it becomes an attack vector.

Multer 2.2.0 and 3.0.0-alpha.2 fix the issue with a new limits.fieldNestingDepth configuration option that caps how deep bracket notation parsing will go. The limit is enforced in multer itself, so it no longer depends on append-field to limit itself.

Affected Systems and Versions

The vulnerability covers multer's entire production history, from the 1.0.0 release onward. Any Node.js application using multer to handle multipart form uploads is affected unless it has been upgraded to one of the patched versions.

Setting limits.fields to a low value is a partial workaround. It can reduce exposure, but it does not fully mitigate the issue, because even a single deeply nested field name can trigger significant resource consumption.

Organizations should also audit their dependency trees for indirect use of multer. Multer has 6,473 dependent packages on npm, so it may be present in applications through frameworks, boilerplate generators, or other middleware libraries that bundle it.

Vendor Security History

Over the past year, multer has had a run of DoS vulnerabilities, each exploiting a different weakness in multipart handling:

The OpenJS Foundation, which hosts multer and Express.js, became a CVE Numbering Authority in June 2025 and has been responsive in issuing patches and coordinated disclosures. UlisesGascon, a contributor to the expressjs organization's security efforts, published the advisory for CVE-2026-5079.

The seven CVEs have different root causes (unhandled exceptions, memory leaks, incomplete cleanup, unbounded recursion). That suggests multipart/form-data parsing is inherently complex in ways that individual fixes cannot fully address. Teams that rely on multer should plan for ongoing patching cycles and add defense-in-depth measures at the infrastructure layer: rate limiting multipart POST requests at the reverse proxy, enforcing maximum request body sizes, and monitoring for anomalous field name patterns.

References

• GitHub Advisory: multer vulnerable to Denial of Service via deeply nested field names (GHSA-72gw-mp4g-v24j)
• OpenJS Foundation CNA Security Advisories
• multer on npm
• expressjs/multer on GitHub
• LinusU/node-append-field on GitHub
• CVE-2026-3520 Detail (NVD)
• CVE-2026-3304: Multer Node.js Middleware DoS (SentinelOne)
• CVE-2026-3520: Multer Vulnerable to Denial of Service (EndorLabs)
• CVE-2026-2359 (Aqua Security)
• CVE-2026-3520 (Red Hat)
• OpenJS Security Checkpoint: 2025 So Far
• May 2025 Security Releases (Express.js)
• Multer DoS Vulnerability CVE-2025-7338 (ZeroPath)
• GHSA-xf7r-hgr6-v32p: Multer vulnerable to DoS via incomplete cleanup
• GHSA-g5hg-p3ph-g8qg: Multer vulnerable to DoS via unhandled exception