8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-3520

CVE-2026-3520: Multer vulnerable to Denial of Service via uncontrolled recursion

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-3520

CVE-2026-3520:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
multer	npm	< 2.1.1	2.1.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic uncontrolled recursion issue within the removeUploadedFiles function in lib/remove-uploaded-files.js. The function uses a recursive pattern to iterate over and remove uploaded files. The patch 7e66481f8b2e6c54b982b34c152479e096ce2752 directly addresses this by changing the synchronous recursive call handleFile(idx + 1) to an asynchronous one using setImmediate. This prevents the call stack from growing indefinitely when processing a large number of files, which could be triggered by a malicious multipart request. The added test case explicitly simulates this scenario with 25,000 files to confirm the fix, reinforcing that removeUploadedFiles is the vulnerable function.

Vulnerable functions

removeUploadedFiles

lib/remove-uploaded-files.js

The vulnerability exists in the `removeUploadedFiles` function, which is responsible for cleaning up files after a request. This function contains a recursive helper function, `handleFile`, that iterates through the list of files to be removed. When used with a storage engine that has a synchronous `_removeFile` method (like the default memory storage), the recursion is also synchronous. If an attacker sends a multipart request with a very large number of small parts, the deep recursion within `removeUploadedFiles` can exceed the Node.js call stack limit, leading to a stack overflow and causing the process to crash, resulting in a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.