TypeError: Cannot read properties of undefined (reading 'length') when fieldNameSize is not set

[dvtradeling]

We use Nest.js FilesInterceptor which uses multer under the hood.

When fieldname is not provided, but fieldNameSize is set, the above line is still executed and TypeError is thrown accordingly.
Check this - https://github.com/expressjs/multer/blob/master/lib/make-middleware.js#L103

We need to prevent it.

For fixing this issue please add this line

[joeyguerra]

Can you set the fieldname to an empty string?

[Markiz9999]

Is there a workaround to prevent this vulnerability?

In my case, sending such a request to the express server crashes the server.

[joeyguerra]

Have you tried passing a field name?

[Markiz9999]

Sure. With the passed field name everything works fine. But the important thing here is to prevent the application from crashing when the client does something illegal (in this case, send a request with an empty field name).

If your question is did I try to send an empty string in the field name, then by default it is an empty string, but in that case the busboy library emits an undefined value.

https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js#L296

partName = undefined;

https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js#L313

if (disp.params.name)
  partName = disp.params.name;

https://github.com/mscdex/busboy/blob/master/lib/types/multipart.js#L358

this.emit(
  'file',
  partName,
  this._fileStream,
  { filename,
    encoding: partEncoding,
    mimeType: partType }
);

[Markiz9999]

Previously, the same case was fixed for fields. So we need the same check for files.

Issue: #553
Fix: #913

[joeyguerra]

I see. Just need to get the same fix in. Got it.

[ctcpip]

released in 2.0.1. thank you!

[ImLunaHey]

curious why the CVE was only issued 2 days ago yet this was a known issue since 2023?

[ctcpip]

@ImLunaHey the tl;dr is: governance and security overhaul within the express org. for more info please see the links below. thanks!

• https://expressjs.com/2025/01/09/rewind-2024-triumphs-and-2025-vision.html
• https://expressjs.com/2025/06/05/vulnerability-reporting-process-overhaul.html