Bug 2525793 (CVE-2026-82333)

Summary: CVE-2026-82333 multer: Multer: Denial of Service via oversized array index in field names
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: abarbaro, akostadi, alizardo, amasferr, dbosanac, dmayorov, dschmidt, gotiwari, ikhan, jcantril, jchui, jhe, jhorak, jlanda, jlledo, jreimann, kshier, ktsao, mdessi, mrizzi, mvyas, nboldt, oaljalju, pantinor, pcattana, psrna, rbobbitt, rhel-process-autobot, rojacob, simaishi, stcannon, tsedmik, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Multer, a Node.js middleware for handling multipart/form-data. A remote attacker can send a specially crafted multipart request containing oversized array indices in field names. This can cause Multer's field parser to synchronously iterate a maximum-length sparse array, which blocks the event loop and prevents the application from processing other requests. This vulnerability leads to a denial of service, making the affected application unresponsive.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2542089, 2542090, 2542091, 2542094, 2542095, 2542087, 2542088, 2542092, 2542093    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-28 22:02:40 UTC 
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other requests. A large numeric array index in the first field allocates a maximum-length sparse array, and a second field with a non-numeric key then triggers a full-length iteration inside the append-field dependency. All versions before 2.3.0 are affected, and this is a remotely triggerable denial of service. multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes. Upgrade to multer 2.3.0 and set limits.fieldArrayIndexLimit to the largest array index your application needs to remediate.