multer CVE-2026-77037

The vulnerable code path is triggered exclusively when multer is configured with its built-in DiskStorage engine - applications using MemoryStorage or a custom storage adapter are not affected. The upload route must be network-reachable by the attacker; per the CVSS vector (AV:N, PR:N), no authentication is required if the route is publicly exposed. Exploitation is constrained by the following limiting factors: (1) only DiskStorage configurations are affected, not MemoryStorage or third-party adapters; (2) authentication on the upload route limits the attack surface to credentialed users; (3) the OS-level per-process FD limit determines how many aborted requests are required before the DoS threshold is reached, providing a window for detection via FD monitoring; and (4) the server process must remain running long enough for FD accumulation to reach the limit. No special protocol state or application-specific configuration beyond a reachable multer DiskStorage upload route is required.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterizes the worst-case exposure: a publicly reachable upload route with no authentication. Real-world risk scales directly with whether the upload endpoint requires authentication - applications that gate uploads behind login materially reduce their exposure. EPSS data was not provided in the intelligence input, so exploitation probability cannot be quantified numerically. KEV status is not confirmed, and no public POC has been identified at time of analysis, meaning this has not demonstrably been weaponized at scale. However, the attack primitive is trivially automatable - any HTTP client capable of sending multipart requests and dropping connections mid-stream can exploit this - which offsets the lack of known POC. The fix is available in multer 2.3.0, making remediation straightforward and the risk window narrow for teams with dependency update pipelines.

An attacker discovers a publicly accessible file upload endpoint in a Node.js application using multer DiskStorage and scripting an HTTP client to send repeated multipart/form-data POST requests that are aborted mid-stream. Each request leaks one file descriptor in the server process; after accumulating enough leaked descriptors to hit the OS process limit, the Node.js process can no longer open new sockets, files, or connections - causing all requests to fail with EMFILE errors and effectively denying service to legitimate users. No public POC has been identified at time of analysis, but the technique requires only standard HTTP tooling.