---
id: "CVE-2026-62966"
kind: "vulnerability"
aliases: ["CVE-2026-62966"]
title: "ESPAsyncWebServer: malformed multipart upload crashes ESP32 devices remotely"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["arduino", "embedded", "esp32", "esp8266", "package", "platformio", "rp2040"]
not_affected_if: ["no-upload-route", "version-3.11.2-or-later"]
published_at: "2026-10-30T21:17:15+00:00"
first_seen_at: "2026-10-30T21:25:53+00:00"
updated_at: "2026-10-30T21:26:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62966", "first_seen_at": "2026-10-30T21:25:53+00:00"}]
---

# ESPAsyncWebServer: malformed multipart upload crashes ESP32 devices remotely

ESPAsyncWebServer is an HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350 boards. A malformed multipart file upload makes the parser write through a null pointer, which reboots an ESP32 and gives a remote attacker a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the `ESPAsyncWebServer` library version in the project's `platformio.ini` or `library.json`, or the Arduino library manager list.
- Check whether any route accepts multipart file uploads or web-OTA updates, since the sources say such a handler must be present.

## Fix

- ESPAsyncWebServer: `3.11.2`

## Timeline

- 2026-10-30T21:25:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62966

## From the sources

ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350. Prior to version 3.11.2, the multipart parser in `src/WebRequest.cpp` frees `_itemBuffer` and sets it to NULL when `BOUNDARY_OR_DATA` matches the closing boundary of a file part, before confirming the following terminator, while leaving `_itemIsFile` true. If the next byte is neither the final closing dashes nor a clean CRLF, the `DASH3_OR_RETURN2` or `EXPECT_FEED2` rewind branch re-injects provisionally consumed bytes through `itemWriteByte`. Because `_itemIsFile` remains true, `_itemBuffer`[`_itemBufferIndex`++] writes through a null pointer. On ESP32 this causes a `StoreProhibited` exception, panic and device reboot, producing remote denial of service. A route with a non-trivial body/upload handler, such as a file-upload or web-OTA endpoint, must be present. This issue is fixed in version 3.11.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_