StackRadar

CVE-2026-3520

High

Advisory

Published 5 Mar 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.007
52nd percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
108
of 17,781 indexed, latest versions
Container images
108
deployed by those charts
Fix available
1 of 1
affected package

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

Carried by container images the latest versions of 108 of 17,781 indexed charts deploy, on 108 images.

Affected packageAffected versionsFixed inImages
multernpm0.1.8, 1.3.0, 1.4.1, 1.4.2+7 more2.1.1108
OSV records
GHSA-5528-5vmv-3xc2

Charts affected

108 by stars
ChartLatestAffected imagesRadar Score
node-redthl-chartsVerified publisher0.1.01 of 1See more

node-red thl-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
nodered/node-red:3.0.2-18e2632a7a35dd
multer@1.4.5-lts.1
2.1.1

Open the chart page →

2,806
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
multer@1.4.4-lts.1
2.1.1

Open the chart page →

17,323
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
multer@2.0.2
2.1.1

Open the chart page →

2,620
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
multer@2.0.2
2.1.1

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
multer@1.4.5-lts.2
2.1.1

Open the chart page →

4,768
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
multer@2.0.1
2.1.1

Open the chart page →

5,984
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
multer@1.4.4
2.1.1

Open the chart page →

5,459
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-3520.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
multer@1.4.5-lts.1
2.1.1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
multer@1.4.5-lts.1
2.1.1

Open the chart page →

16,083

Container images carrying it

108 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
nodered/node-red:4.1.2216e7403aab9
multer@2.0.2
2.1.1
1
nodered/node-red:2.2.2e131dcadfe92
multer@1.4.4
2.1.1
1
nodered/node-red:3.0.2-18e2632a7a35dd
multer@1.4.5-lts.1
2.1.1
1
nodered/node-red-docker:0.19.6-v8070643219ea2
multer@1.4.1
2.1.1
1
ohmyform/ohmyform:1.0.3afe53f4acdb1
multer@1.4.4
2.1.1
1
pawelmalak/flame:2.1.193e7b0abb603
multer@1.4.3
2.1.1
1
pawelmalak/flame:multiarch2.3.19f88b17692a0
multer@1.4.3
2.1.1
1
redis/redisinsight:2.68019fcf774631
multer@1.4.4-lts.1
2.1.1
1
redis/redisinsight:3.2.055542a762210
multer@2.0.2
2.1.1
1
redis/redisinsight:2.46699d341bd329
multer@1.4.4-lts.1
2.1.1
1
redis/redisinsight:3.485562d67a912
multer@2.0.2
2.1.1
1
requarks/wiki:canary-2.5.2438b5865a7386c
multer@1.4.2
2.1.1
1
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
multer@1.4.4-lts.1
2.1.1
1
samajh/alprbackend:latestea742b4372ad
multer@1.4.4
2.1.1
1
sigp/siren:v3.0.42c219b04758e
multer@2.0.1
2.1.1
1
socialmediamacroscope/smile_server:0.3.31a528c794270
multer@1.4.1
2.1.1
1
sysnet4admin/colosseum-cms:loge74b43c7f492
multer@1.4.5-lts.2
2.1.1
1
sysnet4admin/colosseum-prm:log5802bfcd7fed
multer@1.4.5-lts.2
2.1.1
1
th0th/node-red:4.0.3-debiand06fa39f7406
multer@1.4.5-lts.1
2.1.1
1
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
multer@1.4.5-lts.1
2.1.1
1
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
multer@1.4.5-lts.1
2.1.1
1
tooljet/tooljet-ce:v1.18.0c85a4720e42e
multer@1.4.4
2.1.1
1
tzahi12345/youtubedl-material:4.23720b856bd2f
multer@1.4.2
2.1.1
1
vcnngr/pnbackend:latesteaf44ad0ad1f
multer@1.4.5-lts.2
2.1.1
1
visualregressiontracker/api:5.0.11941aeb8c8bf9
multer@1.4.4-lts.1
2.1.1
1
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
multer@1.4.4-lts.1
2.1.1
1
zimengxiong/excalidash-backend:0.4.271273af713c91
multer@2.0.2
2.1.1
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
multer@2.0.2
2.1.1
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
multer@2.0.2
2.1.1
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
multer@2.0.1
2.1.1
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
multer@1.4.5-lts.1
2.1.1
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
multer@1.4.2
2.1.1
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
multer@0.1.8
2.1.1
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
multer@1.4.2
2.1.1
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
multer@1.4.2
2.1.1
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
multer@1.4.5-lts.1
2.1.1
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
multer@1.4.5-lts.1
2.1.1
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
multer@1.4.4
2.1.1
1
ghcr.io/data-fair/portals:18b621866ceb2
multer@1.4.4
2.1.1
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
multer@1.4.4
2.1.1
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
multer@1.4.5-lts.1
2.1.1
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
multer@2.0.2
2.1.1
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
multer@1.4.5-lts.2
2.1.1
1
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
multer@1.4.5-lts.2
2.1.1
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
multer@1.4.2
2.1.1
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
multer@1.4.4-lts.1
2.1.1
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
multer@1.4.5-lts.2
2.1.1
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
multer@1.4.5-lts.1
2.1.1
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
multer@1.4.5-lts.1
2.1.1
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
multer@1.4.2
2.1.1
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.