multer is a middleware for handling multipart/form-data in Node.js.

CVE-2026-77078 is a denial-of-service flaw in multer, the dominant Express.js middleware for multipart/form-data file uploads (~20 million weekly npm downloads). A single HTTP POST containing two specially crafted text field names triggers an uncaught RangeError: Invalid array length inside the append-field dependency. The first field name uses a massive numeric array index (e.g., field[4294967295]) to allocate a maximum-length sparse array; the second field pushes one element past that ceiling. Because multer never wraps the append-field call in a try/catch, the exception propagates uncaught and terminates the Node.js process. All versions before 2.3.0 are affected — that includes every 1.x release and every 2.x release through 2.2.x.

The vendor's HIGH / 7.5 score is fair and accurate. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) correctly reflects that exploitation is unauthenticated, remote, trivially low-complexity, and causes complete availability loss of the affected process. The only mitigating factor the score doesn't capture is that most production Node.js deployments use process managers (PM2, cluster mode, systemd auto-restart) that recover the worker within seconds — so sustained outage requires a loop of requests, not just one. That operational nuance is real but doesn't justify a downgrade: the attacker payload is a single small HTTP request, the package is ubiquitous, and repeated crashes still cause visible service degradation, error spikes, and potential data loss for in-flight uploads.

Why this verdict

• Unauthenticated remote, zero-click, low-complexity — the CVSS base score correctly captures the trivial attack surface. No friction adjustments are warranted for attacker prerequisites because there are none.
• Massive install base — 20M+ weekly downloads and 6,500+ direct dependents make this one of the most widely deployed npm packages. Even a small fraction of vulnerable deployments represents thousands of targets.
• Process managers provide partial operational mitigation — PM2, cluster mode, and systemd restart workers within seconds, converting a single-shot kill into a degraded-service scenario rather than permanent outage. This is real friction but insufficient to downgrade because the attacker payload is trivially repeatable.
• Role multiplier: Multer is a web-application-tier middleware. In *typical roles* (SaaS backends, internal APIs, admin panels), the blast radius is application-level availability loss — impactful but contained to one service. In *high-value roles* (e.g., an Express-based API gateway fronting microservices, or a CI/CD webhook receiver built on Express), a crash loop could cascade to broader service unavailability. However, even in worst-case high-value deployments, the outcome is availability loss only — no code execution, no credential theft, no lateral movement. The blast radius never reaches domain/fleet/supply-chain compromise, so the floor remains HIGH, not CRITICAL.

Why not higher?

Escalation to CRITICAL would require confidentiality or integrity impact (RCE, data exfiltration) or a blast radius reaching fleet/domain/supply-chain compromise. This is a pure availability bug — it crashes one process at a time, with no path to code execution, privilege escalation, or data access. Process managers limit sustained impact. DoS-only CVEs with no secondary chain are correctly capped at HIGH.

Why not lower?

Downgrading to MEDIUM would require meaningful friction in the attack path — authentication requirements, complex preconditions, or a narrow install base. None exist here: the attack is unauthenticated, single-request, trivially craftable from the advisory text alone, and targets one of the most popular npm packages in existence. The payload will be weaponized in nuclei templates within days of disclosure.

1. Set busboy fieldNameSize limit to ≤ 100 bytes — Multer uses busboy under the hood. Configuring limits: { fieldNameSize: 100 } in your multer options truncates oversized field names before they reach append-field, neutralizing the array-index trick. Deploy this configuration change within the noisgate mitigation SLA of 30 days (HIGH), though given the trivial exploit, aim for days not weeks.
2. Add WAF rule blocking numeric array indices > 6 digits in multipart field names — A regex-based WAF rule (e.g., in Cloudflare, AWS WAF, or ModSecurity) matching \[\d{7,}\] in Content-Disposition field names will drop the malicious payload before it reaches your application. This is a defense-in-depth layer while you patch.
3. Enable rate limiting on upload endpoints — Rate limiting (e.g., 10 requests/second per IP on file-upload routes) prevents an attacker from sustaining a crash loop even if individual requests succeed. Use your reverse proxy (nginx limit_req, Envoy, Cloudflare Rate Limiting) to enforce this.
4. Ensure process managers are configured with restart limits and alerting — Verify PM2, systemd, or your container orchestrator (Kubernetes liveness probes) will restart crashed workers quickly but also alert on rapid restart cycles. Set max_restarts with backoff to avoid infinite crash-restart loops consuming resources.

Run this on any host where your Node.js application is deployed, or in your CI pipeline. Requires node and npm in PATH. No elevated privileges needed. Example: bash check_cve_2026_77078.sh /path/to/your/app

#!/usr/bin/env bash
# check_cve_2026_77078.sh — Detect multer < 2.3.0 (CVE-2026-77078)
# Usage: bash check_cve_2026_77078.sh [/path/to/project]
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

PROJECT_DIR="${1:-.}"

if [ ! -d "$PROJECT_DIR/node_modules" ]; then
  echo "UNKNOWN — no node_modules found in $PROJECT_DIR. Run npm install first or provide the correct path."
  exit 2
fi

# Check if multer is installed
MULTER_PKG="$PROJECT_DIR/node_modules/multer/package.json"
if [ ! -f "$MULTER_PKG" ]; then
  echo "PATCHED — multer is not installed in this project (not affected)."
  exit 0
fi

# Extract version
VERSION=$(node -e "console.log(require('$MULTER_PKG').version)" 2>/dev/null)
if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not read multer version from $MULTER_PKG."
  exit 2
fi

# Compare version: vulnerable if < 2.3.0
IS_VULN=$(node -e "
  const semver = require('semver') || null;
  const v = '$VERSION';
  // Simple comparison without semver module
  const parts = v.split('.').map(Number);
  if (parts[0] < 2) { console.log('yes'); }
  else if (parts[0] === 2 && parts[1] < 3) { console.log('yes'); }
  else { console.log('no'); }
" 2>/dev/null)

if [ "$IS_VULN" = "yes" ]; then
  echo "VULNERABLE — multer $VERSION is installed (CVE-2026-77078 affects all versions < 2.3.0). Upgrade to >= 2.3.0."
  exit 1
else
  echo "PATCHED — multer $VERSION is installed (>= 2.3.0, not affected by CVE-2026-77078)."
  exit 0
fi

Sources

1. CVE-2026-77078 — THREATINT
2. GHSA-wc9g-mqfw-jrwm — GitHub Security Advisory (multer)
3. Multer Releases — GitHub
4. Multer — npm
5. Multer Snyk Package Page
6. Express.js June 2026 Security Releases
7. Multer DoS via malformed requests — GHSA-4pg4-qvpc-4q3h (prior CVE pattern)