multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

Published September 8, 2026 CVE-2026-77037

Multer 2.2.0 lets remote attackers make affected Node.js apps unavailable. Repeatedly interrupted uploads can consume the app's limited resources.

Severity
HighCVSS 3.1 · 7.5
Fix
Fixed in 2.3.0Fix recorded 2 days ago
Affected versions
2.2.0 to before 2.3.0
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.35% in 30 daysEPSS, higher than 28% of known flaws
Affects
Multer

How it works

  • The attacker must reach an upload route that stores files on disk.
  • They repeatedly start uploads, then interrupt them before completion.
  • Multer removes each visible file but leaves its system file slot open.
  • Those unfinished uploads retain file slots and storage space until the process exits.
  • Enough attempts can exhaust resources and stop the app from serving users.

What to do

Run npm list multer inside each Node.js project and inspect the displayed version. Version 2.2.0 is affected when the application stores uploaded files on disk. This result shows exposure, not evidence that an attack occurred.

Run this in the application environment you want to check:

npm list multer

Upgrade Multer to version 2.3.0 through the project's normal dependency workflow. No workaround is available, so confirm the installed version after upgrading.

Technical details

CVE-2026-77037 affects Multer 2.2.0 applications using diskStorage. An aborted or truncated upload can leave its destination file descriptor open and retain disk blocks until the Node.js process exits. Repeated requests can exhaust available descriptors and cause denial of service. Multer 2.3.0 closes the destination stream after abnormal upload termination and delays deletion until it closes.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source