Multer CVE-2026-3304

Exploitation requires only that the target application expose an HTTP endpoint that routes requests through Multer to parse multipart/form-data uploads - i.e. any reachable file-upload route. Per the CVSS vector (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special attack requirement: remote unauthenticated exploitation works against default Multer configurations prior to 2.1.0. The practical limiting factor is reachability - the attacker must be able to reach a route that actually invokes Multer; applications that do not accept multipart uploads or that gate upload routes behind authentication or network restrictions reduce exposure correspondingly. Impact is limited to availability (VA:H); there is no path to data disclosure or code execution.

Signals here are mixed and worth weighing carefully. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a cleanly remote, unauthenticated, low-complexity attack, and the high base score (8.7) is driven entirely by the VA:H availability impact - there is no confidentiality or integrity exposure (VC:N/VI:N). Against that, EPSS is very low (0.06%, 17th percentile), this CVE is not in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The practical read: this is a genuine availability risk for any internet-facing service that exposes a Multer-backed upload endpoint, but it is a crash/resource-exhaustion bug, not a code-execution or data-breach issue, so it is a patch-on-schedule priority rather than an emergency for most deployments. One caveat to verify: SSVC fields and POC status were not supplied, so 'automatable' and exploitation-status cannot be confirmed from the data provided.

An attacker locates a public POST endpoint that accepts file uploads (e.g. a profile-picture or document-upload route) backed by a vulnerable Multer version. Because the attack is network-based, unauthenticated, and low-complexity, the attacker repeatedly sends crafted malformed multipart/form-data requests in a tight loop; each leaves resources uncleaned until the Node.js process exhausts memory or file handles and the service becomes unavailable to legitimate users. No public POC is referenced, so the attacker would need to construct the malformed request pattern themselves.