CVE-2026-5079 is a denial of service vulnerability in Multer, a Node.js middleware for handling multipart/form-data, used in Red Hat Ansible Automation Platform 2.1. The flaw allows a remote attacker to send a single HTTP request with deeply nested multipart form data field names, forcing the allocation of deeply nested object structures that consume excessive CPU and memory resources. This resource exhaustion leads to denial of service on affected systems. The vulnerability is relevant for Red Hat products exposing Multer-based services to untrusted network input. Red Hat classifies this as an important security issue with a CVSS v3 base score of 7.5 (high severity).

Successful exploitation results in denial of service due to resource exhaustion (CPU and memory) on affected systems running Multer middleware. This causes service unavailability but does not impact confidentiality or integrity. The vulnerability affects Red Hat Ansible Automation Platform 2.1 components that use Multer for multipart form data processing.

No official patch or fix is currently available from Red Hat. As a partial mitigation, administrators should configure the 'limits.fields' option in the Multer middleware to restrict the maximum number of fields processed from multipart form data, thereby limiting resource consumption. This mitigation requires an application restart to take effect and does not fully prevent the vulnerability. Monitor Red Hat advisories for future patches or updates.