CVE-2026-5038

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html	Vendor Advisory
https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:expressjs:multer::::::node.js::*
	cpe:2.3:a:expressjs:multer:3.0.0:alpha1::::node.js::*

History

No history.

Information

Published : 2026-06-15 16:16

Updated : 2026-06-17 10:58

NVD link : CVE-2026-5038

Mitre link : CVE-2026-5038

CVE.ORG link : CVE-2026-5038

JSON object : View

Products Affected

expressjs

multer

CWE

CWE-459

Incomplete Cleanup

{"id": "CVE-2026-5038", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5038", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-15T16:07:25.876003Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "multer", "product": "multer", "versions": [{"status": "affected", "version": "2.0.0-alpha.1", "lessThan": "2.2.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.2.0", "versionType": "semver"}, {"status": "affected", "version": "3.0.0-alpha.1", "lessThan": "3.0.0-alpha.2", "versionType": "semver"}, {"status": "unaffected", "version": "3.0.0-alpha.2", "versionType": "semver"}], "packageURL": "pkg:npm/multer", "defaultStatus": "unaffected"}]}], "published": "2026-06-15T16:16:34.423", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to \nthe underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required.\n\nPatches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path.\n\nWorkarounds: None."}], "lastModified": "2026-06-17T10:58:19.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:expressjs:multer:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "C3EF2173-8BF7-4B19-9C8F-405232ED2698", "versionEndExcluding": "2.2.0", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:expressjs:multer:3.0.0:alpha1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "F23451DE-A7F1-46E8-9023-CA415ED56050"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}