A malformed multipart/form-data request with deeply nested field names can cause the multer library to allocate arbitrarily deep object structures, draining CPU and memory. This creation of large nested objects leads to a denial of service for the web application. The weakness is a resource exhaustion flaw, lacking any authentication bypass or integrity compromise, and is identified as CWE‑400.

The vulnerability affects the Node.js middleware Multer, commonly used in Express applications. All released versions from 1.0.0 through 2.1.1 inclusive, as well as the pre‑release 3.0.0‑alpha.1, are impacted. Applications that incorporate these packages without patching are potentially vulnerable.

The CVSS score of 7.5 indicates a high severity, and the lack of an EPSS value means the exploitation probability is not quantified in the public data, though the attack can be carried out with a single crafted HTTP request. The vulnerability is not listed in the CISA KEV catalog at this time. An attacker only needs the ability to send a multipart request; no privileged credentials or additional access is required, making the threat very likely for exposed endpoints that process uploads.