---
id: CVE-2026-62966
title: ESPAsyncWebServer multipart parser has null-pointer write
summary: >-
  ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for
  ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart
  parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when
  `BOUNDARY_OR…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-476
  - CWE-672
vendor: ESP32Async
product: ESPAsyncWebServer
affected:
  - ESPAsyncWebServer < 3.11.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-06T18:20:37.577657Z'
published: '2026-10-30'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T18:21:46.069Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62966'
references:
  - url: >-
      https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-8m8p-vhxc-jmjw
    label: >-
      https://github.com/ESP32Async/ESPAsyncWebServer/security/advisories/GHSA-8m8p-vhxc-jmjw
  - url: >-
      https://github.com/ESP32Async/ESPAsyncWebServer/commit/4efbd35e597d91f01749f2d4a14bb78fba8ea02e
    label: >-
      https://github.com/ESP32Async/ESPAsyncWebServer/commit/4efbd35e597d91f01749f2d4a14bb78fba8ea02e
  - url: 'https://github.com/ESP32Async/ESPAsyncWebServer/tree/v3.11.2'
    label: 'https://github.com/ESP32Async/ESPAsyncWebServer/tree/v3.11.2'
tags:
  - cve.org
epss: 0.00426
epssPercentile: 0.37144
ingestedAt: '2026-11-05T16:24:31.464Z'
---

## Overview

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

## Affected

- `ESPAsyncWebServer < 3.11.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.