multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
### Impact A vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using `diskStorage`, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected. ### Patches Users should upgrade to `2.3.0`. ### Workarounds None.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-77037US | — | — | ||
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's d… | ||||
references
External citations — patches, advisories, analysis.
- https://cna.openjsf.org/security-advisories.htmlWEB
- https://github.com/expressjs/multerPACKAGE
- https://github.com/expressjs/multer/commit/eef74440b491ef0f976f3d25895e8089ae495df0WEB
- https://github.com/expressjs/multer/releases/tag/v2.3.0WEB
- https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjfWEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-77037ADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan