Denial of Service Vulnerability in multer Middleware for Node.js

CVE-2026-77037

What is CVE-2026-77037?

The multer middleware for handling multipart/form-data in Node.js versions prior to 2.3.0 contains a denial of service vulnerability. When an upload using the disk storage engine is aborted or truncated, multer removes the visible file but fails to close the underlying write file descriptor. This allows a remote attacker accessing an upload route to send multiple aborted or malformed multipart uploads, leading to a leak of file descriptors and retention of disk blocks. This can ultimately exhaust system resources, resulting in service disruption. The issue is resolved in multer version 2.3.0, which ensures that the destination write stream is properly closed on abnormal terminations and cleanup is executed after the stream is closed.

References