Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-77078, describes a Denial of Service (DoS) in Multer caused by crafted multipart field names leading to an uncaught RangeError: Invalid array length. The provided commit 87a584e8c8d4da873292635fa1d8c4d78d985b76 directly addresses this issue. Analysis of the patch in lib/make-middleware.js reveals that the appendField function, responsible for adding parsed fields to req.body, was previously called without error handling. The fix introduces a try-catch block around the call to appendField(req.body, fieldname, value). This change clearly indicates that the RangeError was being thrown by appendField when processing the malicious fieldname input. By catching this error, the application now gracefully handles the invalid input instead of crashing. The addition of INVALID_FIELD_NAME error code in lib/multer-error.js and the new test case in test/crafted-field-names.js further confirm that appendField is the specific function where the vulnerability manifests, as it's the component attempting to process the malformed array index in the field name.
appendFieldlib/make-middleware.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| multer | npm | < 2.3.0 | 2.3.0 |