When parsing multipart/form-data, the middleware can be forced to allocate a maximum‑length sparse array by including a field name whose numeric index exceeds the typical size. A subsequent field with a non‑numeric key then causes the parser to iterate over the entire array synchronously, blocking the Node.js event loop and preventing the process from serving other requests. The vulnerability is a remotely triggerable denial of service and is classified as CWE‑400.

All installations of the multer middleware on Node.js platforms with a version older than 2.3.0 are affected. Any application that processes multipart/form-data through this library and does not enforce stricter limits on array‑index field names could be compromised.

The vulnerability has a CVSS score of 7.5, indicating high severity. While the EPSS score is not available, the exploit is remotely triggerable via a crafted HTTP request to any endpoint that utilizes multer. The vulnerability has not been listed in CISA’s KEV catalog. Given its remote accessibility and the fact that it fully blocks the event loop, the risk of denial of service is substantial for exposed web services.