What is CVE-2026-3520?

### Impact A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. ### Patches Users should upgrade to `2.1.1` ### Workarounds None ### Resources - https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2 - https://www.cve.org/CVERecord?id=CVE-2026-3520 - https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752 - https://cna.openjsf.org/security-advisories.html

What is the severity of CVE-2026-3520?

CVE-2026-3520 has a CVSS v3 score of 0, which is classified as Low severity.

Is there an exploit available for CVE-2026-3520?

No known public exploits are currently available for CVE-2026-3520.

Is there a patch available for CVE-2026-3520?

Yes, patches are available for CVE-2026-3520. Check the vendor advisories for update instructions.

CVE-2026-3520

Q: What is the severity of CVE-2026-3520?

CVE-2026-3520 has a CVSS v3 score of 0, which is classified as Low severity.

Q: Is there an exploit available for CVE-2026-3520?

No known public exploits are currently available for CVE-2026-3520.

Q: Is there a patch available for CVE-2026-3520?

Yes, patches are available for CVE-2026-3520. Check the vendor advisories for update instructions.

Published: March 9, 2026

Last updated:10 hours ago (March 9, 2026)

Exploit: NoZero-day: NoPatch: YesTrend: Neutral

TL;DR

Updated March 9, 2026

CVE-2026-3520 is a low severity vulnerability with a CVSS score of 0.0. No known exploits currently, and patches are available.

Key Points

1Low severity (CVSS 0.0/10)
2No known public exploits
3Vendor patches are available

Severity Scores

CVSS v30.0

CVSS v20.0

Priority Score0.0

EPSS Score0.0

None

Exploitation LikelihoodMinimal

0.00%EPSS

Very low probability of exploitation

Monitor and patch as resources allow

0.00%

EPSS

0.0

CVSS

Exploit

Yes

Patch

Low Priority

no major risk factors

EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.

Description

Impact

A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.

Patches

Users should upgrade to 2.1.1

Workarounds

None

Resources

https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2
https://www.cve.org/CVERecord?id=CVE-2026-3520
https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752
https://cna.openjsf.org/security-advisories.html

CVSS v3 Breakdown

Attack Vector:-

Attack Complexity:-

Privileges Required:-

User Interaction:-

Scope:-

Confidentiality:-

Integrity:-

Availability:-

Patch References

Github.com

Trend Analysis

Neutral

Advisories

GitHub Advisory NVD

Cite This Page

APA Format

Strobes VI. (2026). CVE-2026-3520 - CVE Details and Analysis. Strobes VI. Retrieved March 10, 2026, from https://vi.strobes.co/cve/CVE-2026-3520

Quick copy link + title

Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.