---
id: CVE-2026-77078
title: >-
  multer: Multer: Denial of Service via crafted multipart field names
  (CVE-2026-77078)
summary: >-
  A flaw was found in multer, a Node.js middleware for handling
  multipart/form-data. A remote attacker can send a small multipart request
  containing two specially crafted text field names. This can cause an uncaught
  error that terminates the…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-248
vendor: Red Hat
product: Red Hat Developer Hub
affected:
  - 3scale_api_management_platform 2
  - developer_hub
  - self_service_automation_portal 2
patched:
  - multer 2.3.0
published: '2026-08-28'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T00:40:33+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77078.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77078.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-77078'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2525771'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-77078'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77078'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: >-
      https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm
  - url: >-
      https://github.com/expressjs/multer/commit/87a584e8c8d4da873292635fa1d8c4d78d985b76
  - url: 'https://github.com/expressjs/multer/releases/tag/v2.3.0'
  - url: 'https://github.com/advisories/GHSA-wc9g-mqfw-jrwm'
tags:
  - csaf
  - vex
  - red-hat
  - exploit-available
  - ghsa
  - npm
epss: 0.00488
epssPercentile: 0.42132
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/wtfkimi/CVE-2026-77078'
  checkedAt: '2026-11-05T15:53:21.278Z'
exploitAvailable: true
aliases:
  - GHSA-wc9g-mqfw-jrwm
ecosystem: npm
ingestedAt: '2026-09-08T22:12:30.967Z'
---

## Overview

A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a small multipart request containing two specially crafted text field names. This can cause an uncaught error that terminates the Node.js process, leading to a Denial of Service (DoS).

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat 3scale API Management Platform 2, Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat 3scale API Management Platform 2, Red Hat Developer Hub · updated 2026-10-02 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77078.json)

**multer: Multer: Denial of Service via crafted multipart field names** — rated Important by Red Hat. Released 2026-08-28, updated 2026-10-02.

Affected:

- Red Hat 3scale API Management Platform 2
- Red Hat Developer Hub
- Self-service automation portal 2

No fix planned:

- Red Hat 3scale API Management Platform 2
- Red Hat Developer Hub

## Remediation

Affected

Workarounds / mitigations:

- Update affected products to versions containing multer 2.3.0 or later. There are no known workarounds - upgrading is the only remediation.

## Package advisory (CVE-2026-77078)

Affected packages:

- `multer < 2.3.0`

Patched in:

- `multer 2.3.0`

Source: https://github.com/advisories/GHSA-wc9g-mqfw-jrwm