A small multipart/form-data request containing two specially crafted text field names can trigger an uncaught RangeError in the Multer middleware, causing the Node.js process to terminate. This occurs when the first field uses a very large numeric array index that allocates a maximum-length sparse array, and the second field pushes past that length in the append‑field dependency, which is not caught by Multer. The resulting process crash results in a denial of service for the application without authentication or privileged access.

The vulnerability affects the Multer middleware for Express in Node.js. All Multer versions prior to 2.3.0 are susceptible. It is relevant to any deployment that uses Multer to handle multipart/form-data.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack can be performed remotely by sending a crafted multipart request to any public or internal endpoint that processes multipart/form-data. No special permissions are required; once the RangeError is triggered the application process terminates, leading to service interruption.