CVE-2026-77078: Remote Denial of Service in Multer Middleware via Array Suffix Handling

The multer middleware is a highly utilized package within the Node.js ecosystem for handling multipart/form-data payloads, primarily used in Express-based web applications. This middleware exposes a substantial attack surface because it processes untrusted file uploads and text field inputs directly from HTTP request streams. A security flaw exists in how the library accumulates multipart field parameters during asynchronous stream parsing.\n\nUnauthenticated remote attackers can leverage this component's parsing behavior to trigger a process-wide Denial of Service (DoS) using minimal network resources. By exploiting this issue, attackers can force target servers offline with a single, low-overhead HTTP request, creating severe operational availability risks.

The flaw lies in the interaction between multer's field accumulation mechanism and the V8 JavaScript engine's internal array limits. When parsing multipart payloads, the middleware uses bracket-notation syntax to construct structured data objects or arrays from incoming field names, such as converting items[] into an active array structure.\n\nThe V8 engine enforces a strict physical boundary of 4,294,967,295 elements for standard array allocations. If an application receives a field explicitly indexed at this limit followed by a push operation, the engine throws a synchronous RangeError: Invalid array length exception. Because the parsing flow operates inside an asynchronous stream lifecycle, the exception cannot be caught by standard outer try-catch blocks. The uncaught error propagates to the top of the event loop, causing the Node.js runtime to terminate immediately.

The vulnerability resides in the make-middleware.js module where fields are appended dynamically. The application processes each field using the appendField utility but fails to enclose this call within any error-handling routine.\n\njavascript\n// Vulnerable implementation in lib/make-middleware.js\nappendField(req.body, fieldname, value)\n\n\nThe patch introduces structured exception handling to intercept failures arising from invalid field mutations. This prevents the runtime from encountering unhandled errors during stream processing.\n\njavascript\n// Patched implementation in lib/make-middleware.js\ntry {\n appendField(req.body, fieldname, value)\n} catch {\n return abortWithCode('INVALID_FIELD_NAME', fieldname)\n}\n\n\nThe error definition mapping is updated in lib/multer-error.js to map the INVALID_FIELD_NAME code to a descriptive string value.\n\njavascript\n// Patched implementation in lib/multer-error.js\nLIMIT_FIELD_ARRAY_INDEX: 'Field name array index too large',\nSTREAM_DESTROYED: 'File stream was destroyed',\nINVALID_FIELD_NAME: 'Invalid field name'\n\n\nThis structural modification is robust as it converts engine-level runtime crashes into recoverable middleware validation errors.

Exploitation requires sending a single, malformed multipart/form-data POST request containing two specifically structured fields. The first field allocates a sparse array at the boundary index of $2^{32} - 2$, which forces the internal JavaScript array length to $2^{32} - 1$. The second field uses empty bracket syntax ([]) to append a new element to the same array name.\n\nmermaid\ngraph LR\n A["Attacker Payload"] --> B["First Part: items[4294967294]='x'"]\n B --> C["Second Part: items[]='y'"]\n C --> D["V8 Engine Array Resize"]\n D --> E["Uncaught RangeError"]\n E --> F["Node.js Process Crash"]\n\n\nBecause sparse arrays do not allocate contiguous memory in V8, the initial allocation does not trigger an out-of-memory error. This ensures the attack remains extremely low-overhead, executing rapidly and consuming negligible network bandwidth. No authentication is necessary to reach the parsing logic if the target endpoint accepts public file uploads or form submissions.

The vulnerability has a CVSS v3.1 base score of 7.5, reflecting a high-severity availability impact. An unauthenticated attacker can consistently terminate the target server process, resulting in persistent denial of service.\n\nIf the application is not configured with automatic process managers like PM2 or orchestrators like Kubernetes, manual administrator intervention is required to restart the service. Even with process auto-restart configurations, continuous exploitation can keep the server in a perpetual crash loop, consuming system resources and preventing legitimate traffic from being served.

The primary solution is to upgrade multer to version 2.3.0 or later, which wraps appendField logic in an appropriate error handling wrapper. For deployments unable to patch immediately, Web Application Firewalls (WAFs) should be configured to drop requests with field names containing excessively large array indices.\n\nAdditionally, ensure that the Node.js application is executed within a robust runtime supervisor such as systemd or container orchestration environments to guarantee automatic service recovery.