CVE-2026-5079

[CVE catalog]

Severity

High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 15, 2026, 1:56:45 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.28% · Oct 25, 2026

A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system. multer: Multer: Denial of Service via deeply nested field names in multipart form data This is an Important denial of service vulnerability in Multer, a Node.js middleware for handling multipart/form-data. An attacker can exploit this flaw by sending a crafted HTTP request with deeply nested field names, leading to excessive resource consumption and service unavailability. This is particularly relevant for Red Hat products that expose Multer-based services to untrusted network input. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.