{"id":"CVE-2026-77078","title":"multer: Multer: Denial of Service via crafted multipart field names (CVE-2026-77078)","summary":"A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a small multipart request containing two specially crafted text field names. This can cause an uncaught error that terminates the…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-248","vendor":"Red Hat","product":"Red Hat Developer Hub","affected":["3scale_api_management_platform 2","developer_hub","self_service_automation_portal 2"],"patched":["multer 2.3.0"],"published":"2026-08-28","updated":"2026-10-02","sourceUpdated":"2026-10-02T00:40:33+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77078.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77078.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-77078"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525771"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77078"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77078"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm"},{"url":"https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76"},{"url":"https://github.com/expressjs/multer/releases/tag/v2.3.0"},{"url":"https://github.com/advisories/GHSA-wc9g-mqfw-jrwm"}],"tags":["csaf","vex","red-hat","exploit-available","ghsa","npm"],"epss":0.00488,"epssPercentile":0.41796,"exploits":{"github":1,"githubRepos":["https://github.com/wtfkimi/CVE-2026-77078"],"checkedAt":"2026-10-27T19:12:55.995Z"},"exploitAvailable":true,"aliases":["GHSA-wc9g-mqfw-jrwm"],"ecosystem":"npm","ingestedAt":"2026-09-08T22:12:30.967Z","slug":"CVE-2026-77078","body":"## Overview\n\nA flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a small multipart request containing two specially crafted text field names. This can cause an uncaught error that terminates the Node.js process, leading to a Denial of Service (DoS).\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat 3scale API Management Platform 2, Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat 3scale API Management Platform 2, Red Hat Developer Hub · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77078.json)\n\n**multer: Multer: Denial of Service via crafted multipart field names** — rated Important by Red Hat. Released 2026-08-28, updated 2026-10-02.\n\nAffected:\n\n- Red Hat 3scale API Management Platform 2\n- Red Hat Developer Hub\n- Self-service automation portal 2\n\nNo fix planned:\n\n- Red Hat 3scale API Management Platform 2\n- Red Hat Developer Hub\n\n## Remediation\n\nAffected\n\nWorkarounds / mitigations:\n\n- Update affected products to versions containing multer 2.3.0 or later. There are no known workarounds - upgrading is the only remediation.\n\n## Package advisory (CVE-2026-77078)\n\nAffected packages:\n\n- `multer < 2.3.0`\n\nPatched in:\n\n- `multer 2.3.0`\n\nSource: https://github.com/advisories/GHSA-wc9g-mqfw-jrwm","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":208899,"id":"CVE-2026-77078","ts":1790061142647,"field":"exploit_available","old":"false","new":"true"}]}