Multer Denial-of-Service Vulnerability via Uncontrolled Recursion

A denial-of-service vulnerability has been identified in Multer, a Node.js middleware for handling multipart/form-data, in versions prior to 2.1.1. The issue allows an attacker to send malformed requests that can cause a stack overflow, leading to a denial-of-service condition. Users are advised to upgrade to version 2.1.1, which includes a patch for this vulnerability. No workarounds are available.

Impact

Exploitation of this vulnerability can lead to a stack overflow, causing a denial-of-service condition where the application becomes unresponsive or crashes.

Reproduction

The vulnerability can be reproduced by uploading a large number of files (approximately 25,000) through a form, which exceeds the typical stack depth in Node.js (about 10,000 to 30,000). This can be done by using a stream that handles 'multipart/form-data' and includes enough files to trigger the stack overflow. The issue occurs when Multer's file handling process is not properly managed, allowing the recursive function to call itself too many times without pausing, eventually exceeding the maximum call stack size.

Remediation

Users should upgrade to Multer version 2.1.1 or later.