CVE-2026-77078High· 7.5▾ MidnightPoC availableA flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a small multipart request containing two specially crafted text field names. This can cause an uncaught error that terminates the…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
1 GitHub repo
0.3% → 0.5%
Last analysed / modified upstream
A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a small multipart request containing two specially crafted text field names. This can cause an uncaught error that terminates the Node.js process, leading to a Denial of Service (DoS).
multer: Multer: Denial of Service via crafted multipart field names — rated Important by Red Hat. Released 2026-08-28, updated 2026-10-02.
Affected:
No fix planned:
Affected
Workarounds / mitigations:
Affected packages:
multer < 2.3.0Patched in:
multer 2.3.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-88932Medium· 5.3multer is a Node.js middleware for handling multipart/form-data uploads
CVE-2026-13697High· 7.4undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)
CVE-2026-14631Medium· 5.3webpack-dev-server versions 5.2.5 and earlier terminate the whole Node.js process when an unauthenticated peer sends either a normal HTTP request with a malformed Host header or a WebSocket upgrade to the default /ws endpoint with a malf…
CVE-2026-113872High· 7.5multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
CVE-2026-114102High· 7.5adm-zip: adm-zip: Denial of Service via malformed ZIP archive decompression (CVE-2026-114102)
CVE-2026-48068High· 7.5grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation (CVE-2026-48068)