CVE-2026-3520: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3520 is a Denial of Service (DoS) vulnerability in Multer, a Node.js middleware for handling multipart/form-data requests, caused by uncontrolled recursion. An unauthenticated remote attacker can send malformed multipart requests to trigger a stack overflow, crashing or hanging the affected application. All Multer versions prior to 2.1.1 for Node.js are affected. The vulnerability was disclosed on March 4, 2026, with a patch released the same day. It carries a CVSS v4.0 base score of 8.7 (High) and a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat).

The root cause is uncontrolled recursion (CWE-674) in Multer's lib/remove-uploaded-files.js. When cleaning up uploaded files, the handleFile function calls itself synchronously via a callback chain — handleFile(idx) → remove → cb() → handleFile(idx+1) — without yielding to the event loop. When processing a large number of files (e.g., 25,000), this deep synchronous call stack exceeds Node.js's maximum call stack size, resulting in a "Maximum call stack size exceeded" error and application crash. The fix wraps the recursive call in setImmediate() to defer execution and break the synchronous call chain (GitHub Commit, GitHub Advisory). No authentication or special privileges are required; the attack is network-accessible with low complexity.

Successful exploitation results in a complete loss of availability for any Node.js application using a vulnerable version of Multer, as the stack overflow causes the application process to crash or become unresponsive. There is no impact on confidentiality or data integrity. Downstream IBM products incorporating Multer — including IBM API Connect, IBM Cloud Pak for Integration, IBM Cloud Pak for AIOps, IBM DevOps Solution Workbench, and IBM watsonx Orchestrate — are also affected, broadening the potential impact across enterprise environments (GitHub Advisory, Red Hat).

No public proof-of-concept exploit code has been reported, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.042–0.067%, placing it in the lower percentiles for near-term exploitation likelihood (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the attack requires no authentication and is trivially executable over the network, making it a low-barrier DoS vector against any exposed file upload endpoint.

1. Reconnaissance: Identify web applications built on Node.js/Express that expose file upload endpoints (e.g., /upload, /api/files) and are likely using Multer versions prior to 2.1.1.
2. Craft malformed multipart request: Construct an HTTP POST request with a Content-Type: multipart/form-data header containing a large number of file fields (e.g., 25,000 or more entries) or a malformed multipart body designed to trigger the cleanup path in Multer.
3. Send the request: Submit the crafted request to the target file upload endpoint using tools such as curl, Python's requests library, or a custom script.
4. Trigger stack overflow: Multer's remove-uploaded-files.js processes the files synchronously in a recursive callback chain, exhausting the Node.js call stack and throwing a "Maximum call stack size exceeded" error.
5. Achieve DoS: The Node.js process crashes or becomes unresponsive, rendering the application unavailable to legitimate users (GitHub Commit, GitHub Advisory).

• Logs: Node.js application logs showing RangeError: Maximum call stack size exceeded errors originating from lib/remove-uploaded-files.js or Multer-related stack frames.
• Logs: Web server access logs showing repeated POST requests to file upload endpoints with unusually large Content-Length values or high numbers of multipart fields from a single source IP.
• Process: Sudden termination or restart of the Node.js application process (e.g., PM2 or systemd restart events) coinciding with multipart upload requests.
• Network: Anomalous spikes in inbound HTTP POST traffic to file upload endpoints, particularly with Content-Type: multipart/form-data headers.

The only available remediation is to upgrade Multer to version 2.1.1 or later, which fixes the recursion issue by wrapping the recursive handleFile call in setImmediate() (GitHub Advisory, GitHub Commit). No official workarounds exist. As a defense-in-depth measure while patching, administrators should consider implementing rate limiting and request size/field count limits on file upload endpoints at the reverse proxy or application layer. IBM has released security bulletins for affected products including API Connect, Cloud Pak for Integration, Cloud Pak for AIOps, DevOps Solution Workbench, and watsonx Orchestrate, and users of those products should apply the relevant IBM fixes (IBM API Connect, IBM Cloud Pak).

Red Hat tracked the vulnerability via Bugzilla (Bug 2444584) and issued a CVE advisory, rating it High severity, with multiple product security team members assigned (Red Hat Bugzilla). IBM issued multiple security bulletins covering affected enterprise products. The vulnerability was reported by researcher yuki-matsuhashi and remediated by ctcpip and UlisesGascon from the Multer/Express.js maintainer team (GitHub Advisory). Community reaction was limited, with no significant social media amplification or major media coverage identified.