multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.

A denial-of-service vulnerability exists in multer, a Node.js middleware for handling multipart/form-data. By sending a small multipart request with two specially crafted text field names, an attacker can cause multer's field parser to synchronously iterate a maximum-length sparse array, blocking the Node.js event loop entirely. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key triggers a full-length iteration inside the append-field dependency. All versions of multer before 2.3.0 are affected. The vulnerability is remotely triggerable with minimal request size, making it highly exploitable. The fix is available in multer 2.3.0, which introduces an opt-in fieldArrayIndexLimit option to reject oversized array indexes. Users are advised to upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit appropriately.