CyberRota Analysis
AI-GeneratedThe multer middleware for Node.js is vulnerable to a denial of service attack due to improper handling of multipart requests, which can lead to synchronous iteration over a maximum-length sparse array, blocking the event loop. This issue affects all versions prior to 2.3.0 and can be exploited remotely, making it critical for developers using multer in their applications to upgrade to version 2.3.0 and configure the fieldArrayIndexLimit option to mitigate the risk. Organizations relying on multer for handling multipart/form-data should prioritize this update to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.
Related CVEs
Other vulnerabilities affecting the same vendor(s)