CVE-2026-3520: expressjs multer Uncontrolled Recursion

Vulnerability summary

CVE-2026-3520 is a high (CVSS 8.7) Uncontrolled Recursion vulnerability in expressjs multer. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.5% of scored vulnerabilities.

Timeline

1. 04-03-2026
   PublishedVulnerability first disclosed.
2. 15-07-2026
   Last modifiedVulnerability information updated.

Description

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.

• CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.