EUVD-2026-36728
GHSA-3p4h-7m6x-2hcm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify Multer upload endpoint
-
DeliveryOpen multipart POST connections
-
ExploitAbort streams mid-upload
-
ExecutionOrphan partial files accumulate
-
PersistDisk partition exhausted
-
ImpactUpload and write operations fail service-wide
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Incomplete cleanup
|
| Exploitation Conditions | Exploitation requires that the target application uses Multer's diskStorage engine (the default DiskStorage configuration, including the no-arg multer() call which writes to os.tmpdir()) on an affected version 2.0.0-alpha.1 through 2.1.1 or 3.0.0-alpha.1, and that an upload route is reachable by the attacker. The attacker must be able to initiate multipart/form-data POSTs and abort or malform them mid-stream. Applications configured exclusively with memoryStorage or a custom storage engine that does not write to fs are not exploitable via this path. No authentication is required (PR:N) and no user interaction is needed (UI:N); limiting factors are filesystem quotas, reverse-proxy upload caps, and any rate limiting in front of the upload endpoint. |
| Impact | All signals point to a credible but bounded availability risk rather than a critical compromise. CVSS 3.1 7.5 with AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H confirms an unauthenticated, low-complexity, network-reachable availability impact only, which aligns with SSVC's Automatable:yes and Technical Impact:partial classifications and reinforces that a scripted abort-flood is feasible. EPSS at 0.25% (16th percentile) and the absence of CISA KEV listing indicate no observed mass exploitation, consistent with no public exploit identified at time of analysis. The practical risk is highest for internet-facing services that expose Multer-backed upload endpoints without disk quotas, rate limiting, or upload-size enforcement; for such deployments this should be prioritized despite the low EPSS, because a single attacker with bandwidth can fill the upload partition. |
| Exploit ScenarioDerived | An unauthenticated attacker repeatedly opens multipart/form-data POST requests to a Multer diskStorage-backed upload endpoint and aborts each TCP connection mid-transfer after sending some payload bytes. Each aborted request leaves an orphan partial file on disk, and a parallelized loop quickly consumes the upload partition, causing write failures across the application until an operator manually clears the temp directory. No public exploit code is required because the behavior is reproducible with curl or any HTTP client that can close a socket mid-stream. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 16, 2026
Denial of service in Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 allows remote unauthenticated attackers to exhaust server disk space when the library is configured with diskStorage. Aborted or malformed multipart uploads leave orphaned partial files because stream destruction is not propagated to the underlying fs.WriteStream, enabling resource exhaustion at scale with no public exploit identified at time of analysis. EPSS probability is low at 0.25% but SSVC marks the issue automatable with partial technical impact.
Earlier versions of this analysis (2)
Denial of service in the Node.js Multer middleware (versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1) allows remote unauthenticated attackers to exhaust disk space on servers using diskStorage by repeatedly aborting multipart uploads, leaving orphaned partial files behind. The flaw stems from Readable.pipe() failing to propagate stream destroy signals to the underlying fs.WriteStream, so cleanup never occurs on the abort path. No public exploit identified at time of analysis, and EPSS is low (0.25%), but the attack requires no application bug and is fully automatable.
Disk space exhaustion in multer's diskStorage handler allows unauthenticated remote attackers to cause a Denial of Service by triggering aborted or malformed multipart uploads. Affected versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 fail to propagate stream destroy signals from Readable.pipe() to the underlying fs.WriteStream, leaving orphaned partial files on disk after each aborted upload. No application-level bug is required - any endpoint using multer with diskStorage is vulnerable by design of the affected library versions. No public exploit or CISA KEV listing is identified at time of analysis.
RemediationAI
Vendor-released patch: upgrade to multer 2.2.0 on the 2.x line or 3.0.0-alpha.2 on the 3.x prerelease, both of which track in-flight write streams and clean them up on the abort path, per the GHSA-3p4h-7m6x-2hcm advisory (https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm) and OpenJS CNA notes (https://cna.openjsf.org/security-advisories.html). The vendor states no workarounds exist, so if you cannot upgrade immediately, switch the storage engine from diskStorage to memoryStorage where upload sizes permit (trade-off: increased RSS memory pressure under load), enforce strict per-request limits in Multer's limits option to cap file size and field count, place the upload partition on a dedicated filesystem with quotas so disk exhaustion cannot affect the root or application volumes, and add a scheduled sweeper job that unlinks files older than a short threshold from the temp upload directory (trade-off: may race with slow legitimate uploads, so tune the age carefully).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Multer is a widely deployed Node.js middleware for Express that handles multipart/form-data uploads, commonly wired into file-upload endpoints. The flaw is a CWE-459 Incomplete Cleanup: when using the diskStorage engine, Multer pipes the inbound Readable into an fs.WriteStream, but Readable.pipe() does not forward a destroy() signal down to the writable side when the upstream request is aborted. The result is that the WriteStream remains open and its partial file is never unlinked, so each aborted upload leaves behind orphan bytes on disk. The affected package is identified by cpe:2.3:a:multer:multer:*:*:*:*:*:*:*:*, covering the 2.x line from 2.0.0-alpha.1 through 2.1.1 and the 3.x prerelease 3.0.0-alpha.1.
Know when Multer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote abort-flood against a reachable diskStorage upload endpoint, no user interaction, availability-only impact through disk exhaustion; no confidentiality or integrity effect.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path.
Workarounds: None.
Executive ViewAI
Multer file upload library versions 2.0.0-alpha.1-2.1.1 and 3.0.0-alpha.1 are vulnerable to remote denial-of-service attacks that exhaust server disk space, disrupting business operations for any application using this library with disk storage configuration. Unauthenticated attackers can trigger the condition at scale by submitting malformed uploads, creating operational burden, service downtime risk, and manual recovery overhead. Vendor patch is available.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticat
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attack
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers t
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js
Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows unauthenti
Applications that configure the multer upload middleware (npm package, versions 2.0.0 through 2.4.x) with an asynchronou
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multi
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass
Exploit-DB