An unauthenticated remote attacker can cause a complete denial of service in Node.js applications using the multer middleware by sending specially crafted multipart requests.

This is an uncontrolled resource consumption vulnerability (CWE-400) occurring within the field parser. An unauthenticated attacker can exploit this by sending a multipart request with two specific, crafted text field names that force the application to synchronously iterate over a maximum-length sparse array, effectively freezing the Node.js event loop.

The successful exploitation of this vulnerability results in a complete denial of service, rendering the affected application unresponsive to all incoming traffic. Given the CVSS score of 7.5, this high-severity flaw poses a significant risk to service availability, which may lead to operational disruption, loss of revenue, and impacts on user trust for critical business applications.

Immediate Action: Upgrade the multer package to version 2.3.0 or later and explicitly configure the fieldArrayIndexLimit option to a threshold appropriate for your application needs.

Proactive Monitoring: Monitor application performance metrics for sudden spikes in event loop lag or unexpected increases in CPU utilization during multipart form processing.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an ingress controller capable of inspecting multipart form data to block requests containing excessively large or malformed array indices.

Public Exploit Available: Unknown

Organizations utilizing the multer middleware must prioritize upgrading to version 2.3.0 immediately. Beyond simply updating the library, administrators must take the additional step of configuring the fieldArrayIndexLimit to ensure that the application is protected against similar resource exhaustion attempts. Failure to implement this configuration change leaves the application susceptible to denial of service even after the library update.