Multer
CVE-2026-3304
HIGH
GHSA-xf7r-hgr6-v32p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity request to a default upload endpoint with no user interaction; impact is availability-only (process exhaustion), so C:N/I:N/A:H.
Primary rating from Vendor (ce714d77-add3-4f53-aff5-83d477b104bb).
CVSS VectorVendor: ce714d77-add3-4f53-aff5-83d477b104bb
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
7Blast Radius
ecosystem impact- 8 npm packages depend on multer (5 direct, 3 indirect)
Ecosystem-wide dependent count for version 2.1.0.
DescriptionCVE.org
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
AnalysisAI
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attackers exhaust server resources by submitting malformed multipart requests, crashing or hanging the upload-handling process. The flaw scores CVSS 4.0 8.7 with an availability-only impact and requires no authentication or user interaction; no public exploit has been identified at time of analysis and EPSS rates near-term exploitation probability very low (0.06%, 17th percentile). A vendor patch (2.1.0) is available and Red Hat has shipped errata, but no workaround exists.
Technical ContextAI
Multer is one of the most widely used Express.js middlewares for parsing multipart/form-data, the encoding browsers use for file uploads. It streams incoming request parts to disk or memory using busboy-based parsing. The root cause is classified as CWE-459 (Incomplete Cleanup): when a malformed or abnormally structured multipart request is received, Multer fails to fully release or tear down associated resources (streams, file handles, buffered state), so repeated malformed requests accumulate and drive resource exhaustion. The affected component is the expressjs:multer package on the Node.js platform (cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:*) for all versions prior to 2.1.0, and because it sits directly on the request-handling path, the defect is reachable by any client that can POST to an upload endpoint.
RemediationAI
Vendor-released patch: upgrade Multer to version 2.1.0 or later, which contains the fix (commit 739919097dde3921ec31b930e4b9025036fa74ee; advisory GHSA-xf7r-hgr6-v32p at https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p). The vendor states no known workarounds are available, so upgrading the dependency is the only complete remediation; bump the version in package.json/lockfile and redeploy, and for Red Hat-packaged consumers apply RHSA-2026:6174 / RHSA-2026:6802. Until the upgrade lands, the only meaningful compensating controls are at the perimeter: place upload endpoints behind a reverse proxy or WAF that enforces strict multipart validation, request size, and part-count limits, and apply per-IP rate limiting on upload routes - accepting the trade-off that aggressive limits can block legitimate large or batch uploads, and that these proxy controls only reduce, not eliminate, the malformed-request exposure since the parsing bug remains in the application.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today