{
  "threat_severity" : "Important",
  "public_date" : "2026-06-15T13:56:45Z",
  "bugzilla" : {
    "description" : "multer: Multer: Denial of Service via deeply nested field names in multipart form data",
    "id" : "2488927",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2488927"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-776",
  "details" : [ "Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.\nPatches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires.\nWorkarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.", "A flaw was found in Multer. A remote attacker can exploit this vulnerability by sending a single HTTP request with crafted multipart form data containing deeply nested field names. This can force the allocation of deeply nested object structures, consuming excessive CPU and memory resources. The vulnerability ultimately leads to a Denial of Service (DoS) for the affected system." ],
  "statement" : "This is an Important denial of service vulnerability in Multer, a Node.js middleware for handling multipart/form-data. An attacker can exploit this flaw by sending a crafted HTTP request with deeply nested field names, leading to excessive resource consumption and service unavailability. This is particularly relevant for Red Hat products that expose Multer-based services to untrusted network input.",
  "affected_release" : [ {
    "product_name" : "Red Hat Ansible Automation Platform 2.1",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:65118",
    "cpe" : "cpe:/a:redhat:ansible_portal:2.1",
    "package" : "ansible-automation-platform/automation-portal:1788775748"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48126",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend:1785332487"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-29T00:00:00Z",
    "advisory" : "RHSA-2026:48126",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend:1785332825"
  }, {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-08-03T00:00:00Z",
    "advisory" : "RHSA-2026:49642",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1785411652"
  }, {
    "product_name" : "Red Hat Developer Hub 1.9",
    "release_date" : "2026-08-10T00:00:00Z",
    "advisory" : "RHSA-2026:52768",
    "cpe" : "cpe:/a:redhat:rhdh:1.9::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1785972843"
  } ],
  "package_state" : [ {
    "product_name" : "Logging Subsystem for Red Hat OpenShift",
    "fix_state" : "Affected",
    "package_name" : "openshift-logging/vector-rhel9",
    "cpe" : "cpe:/a:redhat:logging:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "fido-device-onboard",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "firefox",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "thunderbird",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Affected",
    "package_name" : "firefox",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "thunderbird",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "firefox",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "thunderbird",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Trusted Profile Analyzer",
    "fix_state" : "Not affected",
    "package_name" : "rhtpa/rhtpa-trustification-service-rhel9",
    "cpe" : "cpe:/a:redhat:trusted_profile_analyzer:2"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform/bootc-automation-portal-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-5079\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-5079\nhttps://cna.openjsf.org/security-advisories.html\nhttps://github.com/expressjs/multer/security/advisories/GHSA-72gw-mp4g-v24j" ],
  "name" : "CVE-2026-5079",
  "mitigation" : {
    "value" : "To reduce the impact of this denial of service vulnerability, configure the `limits.fields` option within your `multer` instance to a reasonable maximum value. This action restricts the number of fields processed from multipart form data, thereby limiting the resources an attacker can consume. This partial mitigation requires an application restart to take effect and does not fully prevent the vulnerability.",
    "lang" : "en:us"
  },
  "csaw" : false
}