Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| multer | npm | >= 1.0.0, < 2.2.0 | 2.2.0 |
| multer | npm | >= 3.0.0-alpha.1, < 3.0.0-alpha.2 | 3.0.0-alpha.2 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the multer package, which is used for handling multipart/form-data. The root cause is the lack of a limit on the nesting depth of field names in multipart form submissions. An attacker can send a request with a field name containing a large number of brackets (e.g., field[a][b][c]...), which the append-field dependency attempts to parse into a deeply nested object. This process is resource-intensive and can lead to a Denial of Service.
The patch was identified by comparing the git tags for the vulnerable and patched versions. The key commit, a192b5278f240967f5eb13dd1e9a413b4e1b6533, introduces a new limit option called fieldNestingDepth.
The analysis of the commit's changes points to the makeMiddleware function in lib/make-middleware.js. This function is responsible for creating the middleware that processes the incoming form data. The patch adds a check within the busboy.on('field', ...) event listener to validate the nesting depth of each field name against the configured fieldNestingDepth limit. If the depth is exceeded, the request is aborted.
Therefore, the makeMiddleware function is identified as the source of the vulnerable logic, as it constructs the middleware where the unchecked parsing occurs. During runtime exploitation, this function and the anonymous functions within it would be on the call stack as the multipart data is being processed.
makeMiddlewarelib/make-middleware.js