Denial of Service Vulnerability in Multer Disk Storage by Express.js

CVE-2026-5038

What is CVE-2026-5038?

Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 face a Denial of Service vulnerability in disk storage configurations. This issue enables attackers to exploit aborted or malformed multipart uploads, resulting in orphaned partial files on disk. The underlying problem lies in the Readable.pipe() mechanism, which fails to propagate the stream destroy signal to the associated fs.WriteStream. Consequently, attackers can potentially deplete server disk space without any bugs in the application code. To mitigate this issue, users are urged to upgrade to Multer 2.2.0 or 3.0.0-alpha.2 which feature enhanced management of in-flight write streams.

References