Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
References
O4FDev Reporter
UlisesGascon Remediation developer
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single
multipart/form-datarequest. Two specially crafted text field names cause an uncaughtRangeError: Invalid array lengthinside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.Patches
Users should upgrade to
2.3.0.Workarounds
None.
References