CVE-2026-77037

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cna.openjsf.org/security-advisories.html	Vendor Advisory
https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:expressjs:multer:2.2.0:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-08-28 22:16

Updated : 2026-09-02 14:47

NVD link : CVE-2026-77037

Mitre link : CVE-2026-77037

CVE.ORG link : CVE-2026-77037

JSON object : View

Products Affected

expressjs

multer

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-459

Incomplete Cleanup

{"id": "CVE-2026-77037", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-77037", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-31T18:41:18.978508Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "ce714d77-add3-4f53-aff5-83d477b104bb", "affectedData": [{"vendor": "multer", "product": "multer", "versions": [{"status": "affected", "version": "2.2.0", "lessThan": "2.3.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.3.0", "versionType": "semver"}], "packageURL": "pkg:npm/multer", "defaultStatus": "unaffected"}]}], "published": "2026-08-28T22:16:53.627", "references": [{"url": "https://cna.openjsf.org/security-advisories.html", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}, {"url": "https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf", "tags": ["Vendor Advisory"], "source": "ce714d77-add3-4f53-aff5-83d477b104bb"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ce714d77-add3-4f53-aff5-83d477b104bb", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-459"}]}], "descriptions": [{"lang": "en", "value": "multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate."}], "lastModified": "2026-09-02T14:47:21.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:expressjs:multer:2.2.0:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "14190A67-54C6-48EC-9070-A611B6817F47"}], "operator": "OR"}]}], "sourceIdentifier": "ce714d77-add3-4f53-aff5-83d477b104bb"}