GitHub Advisoryadvisory · npm

GHSA-qfvm-cv95-jqjf multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

HIGH Published 2026-09-08 Modified 2026-09-08 Official page ↗
Aliases
CVE-2026-77037
Ecosystem
npm
Packages
multer
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-459
Reviewed
2026-09-08

Affected packages

• npm multer: >= 2.2.0, < 2.3.0 → fixed in 2.3.0

Description

Impact A vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using `diskStorage`, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected. Patches Users should upgrade to `2.3.0`. Workarounds None.

Related

Alias · CVE (1)

  • CVE-2026-77037 multer is a middleware for handling multipart/form-data in Node.js. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-459 Incomplete Cleanup weakness

References