The multer middleware for Node.js is vulnerable to a remotely triggerable denial of service attack that can crash the entire application process.

This vulnerability is an uncaught exception (CWE-248) triggered by sending a specially crafted multipart request containing two specific text field names. The input forces the process to allocate an invalid array length, which is not properly handled by the middleware, leading to an unauthenticated remote denial of service.

The exploitation of this vulnerability results in the immediate termination of the host Node.js process, causing a denial of service for any application relying on the affected middleware. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to service availability and business continuity, as it requires no authentication to execute and can be triggered by a small, simple network request.

Immediate Action: Update the multer package to version 2.3.0 or later to include the necessary exception handling.

Proactive Monitoring: Monitor application logs for repeated process crashes or recurring RangeError exceptions associated with multipart form data processing.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter or block malformed multipart/form-data requests that contain suspicious or excessively large numeric index values in field names.

Public Exploit Available: No

This vulnerability presents a clear risk to service availability due to the ease of triggering a process crash from an unauthenticated network position. Organizations should prioritize updating to multer version 2.3.0 immediately to resolve the underlying exception handling issue and prevent potential service disruption.