Which versions of Multer are affected by CVE-2026-2359?

Multer, the widely-adopted file-upload middleware for Express.js applications, is vulnerable to resource exhaustion attacks from unauthenticated users who can trigger uncontrolled memory consumption…. A patch is available.

How to fix or mitigate CVE-2026-2359?

Within 24 hours: inventory all Node.js services using Multer (check package.json dependencies for versions < 2.1.0); prioritize applications with public-facing upload functionality. Within 7 days: upgrade Multer to version 2.1.0 or later across all affected services and conduct regression testing on file upload workflows. Within 30 days: verify patch deployment across all production environments, confirm monitoring is in place for upload endpoint performance, and close vulnerability tracking records.

Multer CVE-2026-2359

Q: What is the CVSS score of CVE-2026-2359?

CVE-2026-2359 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

HIGH

Missing Release of Resource after Effective Lifetime (CWE-772)

2026-02-27 ce714d77-add3-4f53-aff5-83d477b104bb

GHSA-v52c-386h-88mc

Denial Of Service Node.js File Upload Multer Expressjs

8.7

CVSS 4.0 · Vendor: ce714d77-add3-4f53-aff5-83d477b104bb

Severity by source

Vendor (ce714d77-add3-4f53-aff5-83d477b104bb) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote, unauthenticated, no-interaction abuse of any Multer upload endpoint (AV:N/AC:L/PR:N/UI:N) causing resource exhaustion with availability-only impact (A:H, C/I:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

7.5 HIGH

qualitative

Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).

CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 30, 2026 - 05:13 vuln.today

v2 (cvss_changed)

Analysis Updated

Jun 30, 2026 - 05:10 vuln.today

v1 (cvss_changed)

Re-analysis Queued

Jun 30, 2026 - 03:24 vuln.today

cvss_changed

CVSS changed

Jun 30, 2026 - 03:24 NVD

8.7 (HIGH)

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Feb 27, 2026 - 16:16 nvd

N/A

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

8 npm packages depend on multer (5 direct, 3 indirect)

Ecosystem-wide dependent count for version 2.1.0.

DescriptionCVE.org

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

AnalysisAI

Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated attackers exhaust server resources by abruptly dropping the connection mid file-upload, leaving allocated resources unreleased. The flaw maps to CWE-772 (missing release of resource) and carries a CVSS 4.0 base score of 8.7 driven entirely by availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%), but a fixed release (2.1.0) is available and no workarounds exist.

Technical ContextAI

Multer is the de-facto file-upload middleware for the Express.js / Node.js ecosystem, parsing multipart/form-data request bodies (via busboy) into files and fields on the request object. The affected component is identified by CPE cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:* across all versions prior to 2.1.0. The root cause is CWE-772, Missing Release of Resource after Effective Lifetime: when a client terminates the TCP/HTTP connection partway through an upload, Multer fails to clean up the streams, buffers, file handles, or temporary state associated with the in-flight request. Repeated abandoned uploads therefore accumulate unreleased resources (memory, file descriptors, event listeners), degrading or crashing the Node.js process.

RemediationAI

Vendor-released patch: Multer 2.1.0 - upgrade the multer dependency to 2.1.0 or later (e.g. update package.json and run your package manager, then redeploy), as this is the only supported remediation; the advisory explicitly states no known workarounds are available. The fix is in commit cccf0fe0e64150c4f42ccf6654165c0d66b9adab and documented in GHSA-v52c-386h-88mc (https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc). Red Hat users should apply RHSA-2026:6174 and RHSA-2026:6802 (https://access.redhat.com/errata/RHSA-2026:6174). As compensating controls until patched, place upload endpoints behind a reverse proxy or WAF that enforces request/upload timeouts and aborts slow or incomplete uploads, apply per-connection and per-IP rate limiting on upload routes, and constrain Node.js process resources (memory/file-descriptor limits) so a single process exhaustion does not take down the host - noting these reduce but do not eliminate the underlying resource leak and may reject some legitimate large or slow uploads.