Multer
CVE-2026-2359
HIGH
GHSA-v52c-386h-88mc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Express app upload endpoint
-
DeliveryOpen multipart/form-data upload requests
-
ExploitDrop connections mid-upload
-
ExecutionLeak unreleased per-request resources
-
PersistExhaust memory/file descriptors
-
ImpactService denial of service
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | Exploitation requires that the target application uses Multer (version below 2.1.0) to handle multipart/form-data file uploads and exposes at least one reachable upload endpoint; the attacker simply opens upload requests and terminates the connection before completion to leak resources. Per the CVSS 4.0 vector (PR:N/UI:N/AT:N), no authentication, user interaction, or special preconditions are needed against such an endpoint. The principal limiting factors are deployment-specific: the endpoint must be reachable by the attacker (internet-exposed upload routes are most at risk, internal/authenticated-only routes far less so), and effective impact scales with the number of concurrent abandoned connections allowed, so upstream timeouts, rate limits, or connection caps materially constrain real-world exploitability. |
| Impact | Signals are mostly consistent and point to a real but availability-only concern. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a trivially reachable, network-based, unauthenticated, no-interaction attack, and the high availability sub-score (VA:H) with no confidentiality or integrity impact (VC:N/VI:N) matches a pure DoS - yielding the 8.7 'high' rating. Against that, the EPSS score is only 0.06% (17th percentile), there is no CISA KEV listing, and no public proof-of-concept is referenced, so widespread or imminent exploitation is not indicated. The practical risk is highest for internet-facing Node.js services that accept file uploads from untrusted clients; for internal or authenticated-only upload endpoints the realistic exposure is lower despite the high CVSS. Net: a legitimate patch-worthy DoS, not a remote-code-execution emergency - prioritize based on whether the upload endpoint is exposed to untrusted traffic. |
| Exploit ScenarioDerived | An attacker repeatedly initiates multipart/form-data file uploads against a public Express.js endpoint that uses Multer and deliberately drops each connection mid-transfer, so the server never releases the per-upload resources. Sustained over many concurrent abandoned uploads, this exhausts memory or file descriptors and renders the service unresponsive. No authentication, user interaction, or special tooling is required (AV:N/AC:L/PR:N/UI:N), though no public proof-of-concept is currently referenced. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jun 30, 2026
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated attackers exhaust server resources by abruptly dropping the connection mid file-upload, leaving allocated resources unreleased. The flaw maps to CWE-772 (missing release of resource) and carries a CVSS 4.0 base score of 8.7 driven entirely by availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%), but a fixed release (2.1.0) is available and no workarounds exist.
Earlier versions of this analysis (1)
Denial of service in Multer (the Express.js multipart/form-data upload middleware) before 2.1.0 lets remote unauthenticated attackers exhaust server resources by abruptly dropping the connection mid-upload, leaving file-handling resources unreleased (CWE-772). The flaw affects any Node.js application using a vulnerable Multer release to accept file uploads, requires no authentication or user interaction, and is fixed in 2.1.0. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.06%), but the CVSS 4.0 score of 8.7 reflects the high availability impact and trivial network attack path.
RemediationAI
Vendor-released patch: Multer 2.1.0 - upgrade the multer dependency to 2.1.0 or later (e.g. update package.json and run your package manager, then redeploy), as this is the only supported remediation; the advisory explicitly states no known workarounds are available. The fix is in commit cccf0fe0e64150c4f42ccf6654165c0d66b9adab and documented in GHSA-v52c-386h-88mc (https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc). Red Hat users should apply RHSA-2026:6174 and RHSA-2026:6802 (https://access.redhat.com/errata/RHSA-2026:6174). As compensating controls until patched, place upload endpoints behind a reverse proxy or WAF that enforces request/upload timeouts and aborts slow or incomplete uploads, apply per-connection and per-IP rate limiting on upload routes, and constrain Node.js process resources (memory/file-descriptor limits) so a single process exhaustion does not take down the host - noting these reduce but do not eliminate the underlying resource leak and may reject some legitimate large or slow uploads.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Multer is the de-facto file-upload middleware for the Express.js / Node.js ecosystem, parsing multipart/form-data request bodies (via busboy) into files and fields on the request object. The affected component is identified by CPE cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:* across all versions prior to 2.1.0. The root cause is CWE-772, Missing Release of Resource after Effective Lifetime: when a client terminates the TCP/HTTP connection partway through an upload, Multer fails to clean up the streams, buffers, file handles, or temporary state associated with the in-flight request. Repeated abandoned uploads therefore accumulate unreleased resources (memory, file descriptors, event listeners), degrading or crashing the Node.js process.
Know when Multer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Remote, unauthenticated, no-interaction abuse of any Multer upload endpoint (AV:N/AC:L/PR:N/UI:N) causing resource exhaustion with availability-only impact (A:H, C/I:N).
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
Lifecycle Timeline
5DescriptionCVE.org
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
Blast Radius
ecosystem impact- 8 npm packages depend on multer (5 direct, 3 indirect)
Ecosystem-wide dependent count for version 2.1.0.
Executive ViewAI
Multer, the widely-adopted file-upload middleware for Express.js applications, is vulnerable to resource exhaustion attacks from unauthenticated users who can trigger uncontrolled memory consumption through interrupted uploads. Organizations relying on Multer for file handling functionality face potential service unavailability and operational disruption; the vulnerability affects any production application running Multer versions prior to 2.1.0. Immediate patching is critical to mitigate availability risk.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticat
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attack
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers t
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js
Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows unauthenti
Denial of service in Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 allows remote unauthenticated attacke
Applications that configure the multer upload middleware (npm package, versions 2.0.0 through 2.4.x) with an asynchronou
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multi
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass
Exploit-DB