{"id":"CVE-2026-62966","kind":"vulnerability","aliases":["CVE-2026-62966"],"related":[],"title":"ESPAsyncWebServer: malformed multipart upload crashes ESP32 devices remotely","description":"ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.","summary":"ESPAsyncWebServer is an HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350 boards. A malformed multipart file upload makes the parser write through a null pointer, which reboots an ESP32 and gives a remote attacker a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arduino","embedded","esp32","esp8266","package","platformio","rp2040"],"not_affected_if":["no-upload-route","version-3.11.2-or-later"],"how_to_check":"- Look for the `ESPAsyncWebServer` library version in the project's `platformio.ini` or `library.json`, or the Arduino library manager list.\n- Check whether any route accepts multipart file uploads or web-OTA updates, since the sources say such a handler must be present.","fix":"- ESPAsyncWebServer: `3.11.2`","status":"open","published_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:43+00:00","updated_at":"2026-10-30T21:26:43+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T21:26:43Z","model":"claude-haiku-5-5","output":{"fix":"- ESPAsyncWebServer: `3.11.2`","reach":"network","title":"ESPAsyncWebServer: malformed multipart upload crashes ESP32 devices remotely","impact":"low","summary":"ESPAsyncWebServer is an HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350 boards. A malformed multipart file upload makes the parser write through a null pointer, which reboots an ESP32 and gives a remote attacker a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["esp32","esp8266","rp2040","arduino","platformio","embedded"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"remote attacker reboots the device, causing denial of service","analyst_note":"","how_to_check":"- Look for the `ESPAsyncWebServer` library version in the project's `platformio.ini` or `library.json`, or the Arduino library manager list.\n- Check whether any route accepts multipart file uploads or web-OTA updates, since the sources say such a handler must be present.","plain_action":"","needs_analyst":false,"not_affected_if":["version-3.11.2-or-later","no-upload-route"],"who_is_affected":"Devices running ESPAsyncWebServer older than version 3.11.2 that expose a route with a non-trivial body or upload handler, such as a file-upload or web-OTA endpoint, are exposed. Projects without such a route, or that run a patched version, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4422,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-62966':11A,14A '3.11.2':81C,202C 'arduino':15B 'asynchron':66C 'attack':58B 'board':36B 'body/upload':180C 'boundari':95C,101C 'branch':137C 'byte':118C,143C 'caus':160C 'clean':127C 'close':100C,123C 'confirm':107C 'consum':142C 'crash':5A 'crlf':128C 'cve':9A,12A 'dash':124C 'dash3':130C 'data':97C 'denial':60B,170C 'devic':7A,166C 'embed':16B 'endpoint':192C 'esp32':6A,17B,31B,53B,73C,158C 'esp8266':18B,32B,74C 'espasyncwebserv':1A,22B,63C 'except':163C 'expect':134C 'feed2':135C 'file':40B,104C,186C 'file-upload':185C 'final':122C 'fix':199C 'follow':109C 'free':87C 'give':55B 'handler':181C 'http':25B,67C 'inject':140C 'issu':197C 'itembuff':88C,150C 'itembufferindex':151C 'itemisfil':113C,147C 'itemwritebyt':145C 'leav':112C 'librari':29B,71C 'make':42B 'malform':2A,38B 'match':98C 'multipart':3A,39B,83C 'must':193C 'neither':120C 'next':117C 'non':178C 'non-trivi':177C 'null':48B,93C,155C 'ota':191C 'packag':19B 'panic':164C 'parser':44B,84C 'part':105C 'platformio':20B 'pointer':49B,156C 'present':195C 'prior':78C 'produc':168C 'provision':141C 're':139C 're-inject':138C 'reboot':51B,167C 'remain':148C 'remot':8A,57B,169C 'return2':132C 'rewind':136C 'rout':174C 'rp2040':21B,33B,75C 'rp2350':35B,77C 'server':28B,70C 'servic':62B,172C 'set':90C 'src/webrequest.cpp':86C 'storeprohibit':162C 'termin':110C 'trivial':179C 'true':114C,149C 'upload':4A,41B,187C 'version':80C,201C 'web':190C 'web-ota':189C 'websocket':27B,69C 'write':45B,152C","nicknames":[],"mitigations":[],"who_affected":"Devices running ESPAsyncWebServer older than version 3.11.2 that expose a route with a non-trivial body or upload handler, such as a file-upload or web-OTA endpoint, are exposed. Projects without such a route, or that run a patched version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-30T21:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62966","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62966","severity":null,"published_at":"2026-10-30T21:17:15+00:00","modified_at":"2026-10-30T21:17:15+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}