EUVD-2026-36728
GHSA-3p4h-7m6x-2hcm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Unauthenticated remote abort-flood against a reachable diskStorage upload endpoint, no user interaction, availability-only impact through disk exhaustion; no confidentiality or integrity effect.
Primary rating from Vendor (openjs).
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path.
Workarounds: None.
AnalysisAI
Denial of service in Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 allows remote unauthenticated attackers to exhaust server disk space when the library is configured with diskStorage. Aborted or malformed multipart uploads leave orphaned partial files because stream destruction is not propagated to the underlying fs.WriteStream, enabling resource exhaustion at scale with no public exploit identified at time of analysis. EPSS probability is low at 0.25% but SSVC marks the issue automatable with partial technical impact.
Technical ContextAI
Multer is a widely deployed Node.js middleware for Express that handles multipart/form-data uploads, commonly wired into file-upload endpoints. The flaw is a CWE-459 Incomplete Cleanup: when using the diskStorage engine, Multer pipes the inbound Readable into an fs.WriteStream, but Readable.pipe() does not forward a destroy() signal down to the writable side when the upstream request is aborted. The result is that the WriteStream remains open and its partial file is never unlinked, so each aborted upload leaves behind orphan bytes on disk. The affected package is identified by cpe:2.3:a:multer:multer:*:*:*:*:*:*:*:*, covering the 2.x line from 2.0.0-alpha.1 through 2.1.1 and the 3.x prerelease 3.0.0-alpha.1.
RemediationAI
Vendor-released patch: upgrade to multer 2.2.0 on the 2.x line or 3.0.0-alpha.2 on the 3.x prerelease, both of which track in-flight write streams and clean them up on the abort path, per the GHSA-3p4h-7m6x-2hcm advisory (https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm) and OpenJS CNA notes (https://cna.openjsf.org/security-advisories.html). The vendor states no workarounds exist, so if you cannot upgrade immediately, switch the storage engine from diskStorage to memoryStorage where upload sizes permit (trade-off: increased RSS memory pressure under load), enforce strict per-request limits in Multer's limits option to cap file size and field count, place the upload partition on a dedicated filesystem with quotas so disk exhaustion cannot affect the root or application volumes, and add a scheduled sweeper job that unlinks files older than a short threshold from the temp upload directory (trade-off: may race with slow legitimate uploads, so tune the age carefully).
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.1 allows remote unauthenticat
Denial of service in Multer (the Express/Node.js multipart/form-data middleware) before version 2.1.0 lets remote attack
Denial of service in Multer (Express.js multipart/form-data middleware) before version 2.1.0 lets remote unauthenticated
File descriptor exhaustion in multer 2.2.0's DiskStorage engine allows remote unauthenticated attackers to cause denial
Remote denial-of-service in the Node.js multer middleware (all versions before 2.3.0) allows unauthenticated attackers t
Event loop exhaustion in multer (all versions before 2.3.0) allows unauthenticated remote attackers to render a Node.js
Denial of service in the Express.js multer middleware (versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1) allows unauthenti
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multi
Race condition in multer's file stream handling allows uploaded files exceeding the configured fileSize limit to bypass
Same weakness CWE-459 – Incomplete Cleanup
View allSame technique Denial Of Service
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today