CVE-2026-82333

multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.

• CWE-400

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/expressjs/multer/security/advisories/GHSA-535w-7cp7-47q4Vendor Advisory

Published

Aug 28, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82327A flaw was found in libsolv, a dependency-resolution library…5.5
• CVE-2026-82328A flaw was found in the file-ico plugin in GIMP. When proces…6.1
• CVE-2026-82329JFrog Artifactory contains an authentication weakness that, …9.8
• CVE-2026-8233A vulnerability was determined in Dotouch XproUPF 2.0.0-rele…4.6
• CVE-2026-82330A flaw was found in the file-pvr plugin in GIMP. When proces…6.1
• CVE-2026-82331Improper link resolution before file access ('link following…9.8
• CVE-2026-82334IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable …9.1
• CVE-2026-82335IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable …9.8
• CVE-2026-8234A security vulnerability has been detected in EFM ipTIME A80…8.8
• CVE-2026-82340IBM Guardium Data Protection 12.2 is vulnerable to unauthent…9.8
• CVE-2026-82343A flaw was found in the file-psd plugin in GIMP. When proces…6.1
• CVE-2026-82344IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a h…9.8