CyberRota Analysis
AI-GeneratedThe multer middleware for handling multipart/form-data in Node.js is vulnerable to a denial-of-service attack due to an uncaught RangeError caused by specially crafted multipart requests. This flaw can lead to the termination of the Node.js process, impacting applications that rely on multer for file uploads. Organizations using versions prior to 2.3.0 should prioritize upgrading to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Related CVEs
Other vulnerabilities affecting the same vendor(s)