StackRadarChart IndexLive demo

CVE-2026-3520

High

Advisory

Published 5 Mar 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.007; 52nd percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 108; of 17,781 indexed, latest versions
Container images: 108; deployed by those charts
Fix available: 1 of 1; affected package

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

Carried by container images the latest versions of 108 of 17,781 indexed charts deploy, on 108 images.

Affected package	Affected versions	Fixed in	Images
multernpm	0.1.8, 1.3.0, 1.4.1, 1.4.2+7 more	2.1.1	108

OSV records: GHSA-5528-5vmv-3xc2

Charts affected

108 by stars

Chart

Latest

Affected images

Radar Score

node-redthl-charts

1 of 1 See more

node-red thl-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-3520.

Container image	Digest	Package	Fixed in
nodered/node-red :3.0.2-18	e2632a7a35dd	multer@1.4.5-lts.1	2.1.1

Open the chart page →

2,806

tfy-distributortruefoundry

1 of 4 See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-3520.

Container image	Digest	Package	Fixed in
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	multer@1.4.4-lts.1	2.1.1

Open the chart page →

17,323

excalidashunxwares

1 of 2 See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-3520.

Container image	Digest	Package	Fixed in
zimengxiong/excalidash-backend :0.4.27	1273af713c91	multer@2.0.2	2.1.1

Open the chart page →

2,620

evolution-apivcnngr

1 of 5 See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-3520.

Container image	Digest	Package	Fixed in
evoapicloud/evolution-api :latest	966625532d90	multer@2.0.2	2.1.1

Open the chart page →

3,746

simple-prima-notavcnngr

1 of 4 See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-3520.

Container image	Digest	Package	Fixed in
vcnngr/pnbackend :latest	eaf44ad0ad1f	multer@1.4.5-lts.2	2.1.1

Open the chart page →

4,768

sirenwateim

1 of 1 See more

5,984

wikiwikijs

1 of 2 See more

5,459

workadventureworkadventure

2 of 9 See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-3520.

Container image	Digest	Package	Fixed in
thecodingmachine/workadventure-map-storage :v1.17.7	5bdab56da2fa	multer@1.4.5-lts.1	2.1.1
thecodingmachine/workadventure-uploader :v1.17.7	3ccd467543b3	multer@1.4.5-lts.1	2.1.1

Open the chart page →

16,083

Container images carrying it

108 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/sct/overseerr :1.35.0	6197516c9d7b	multer@1.4.5-lts.1	2.1.1	1
ghcr.io/seerr-team/seerr :v3.2.0	c4cbd5121236	multer@1.4.5-lts.1	2.1.1	1
ghcr.io/solucteam/outscale-s3-explorer :v1.0.0	9665c3e71889	multer@1.4.5-lts.2	2.1.1	1
ghcr.io/woodenmaiden/relfinderreformedapi :1.1.2	0708d30433d4	multer@1.4.4-lts.1	2.1.1	1
public.ecr.aws/aws-containers/retail-store-sample-checkout :1.3.0	687aa68dd490	multer@2.0.1	2.1.1	1
public.ecr.aws/jtekt-corporation/image-storage-service :v1.16.17	b1493760c716	multer@1.4.5-lts.1	2.1.1	1
public.ecr.aws/truefoundrycloud/async-service-distributor :5d48113bc678d694a0c8f8dabb2207c5aa2cfc53	f74851ce31f5	multer@1.4.4-lts.1	2.1.1	1
quay.io/seamware/onboarding :0.2.2	b406475f9f00	multer@2.0.2	2.1.1	1