{"items":[{"id":"NVI-00015399","kind":"vulnerability","title":"multer vulnerable to Denial of Service via oversized array index in field names","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-535w-7cp7-47q4","CVE-2026-82333"],"plain_summary":"GitHub lists this reviewed advisory for multer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-6421b0c6a89ed4e5a01f56e05f81fbe9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-08T21:28:45.000Z","value":"7.5 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-6421b0c6a89ed4e5a01f56e05f81fbe9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-6421b0c6a89ed4e5a01f56e05f81fbe9","url":"https://github.com/advisories/GHSA-535w-7cp7-47q4","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-535w-7cp7-47q4","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T22:54:12.705Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-6421b0c6a89ed4e5a01f56e05f81fbe9"],"technology":"multer","known_exclusions":[],"conditions_summary":"### Impact\n\nmulter is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The `append-field` dependency parses bracket notation in field names, and a large numeric index such as `items[4294967294]` forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.\n\n### Patches\n\nUsers should upgrade to `2.3.0` and configure `limits.fieldArrayIndexLimit` to the minimum array index their application requires.\n\n### Workarounds\n\nNone.","public_affected_ranges":["< 2.3.0"]}],"null_published_at":"2026-11-03T10:03:31.362Z","source_updated_at":"2026-09-08T21:28:45.000Z","source_disclosed_at":"2026-09-08T21:28:43.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T22:54:12.705Z"}],"next_cursor":null,"snapshot_revision":"42594"}