Denial of Service Vulnerability in Multer by Express.js

CVE-2026-88932

What is CVE-2026-88932?

Multer, a middleware for handling multipart/form-data uploads in Node.js, is vulnerable to a denial of service attack due to improper cleanup of aborted uploads. In versions 2.2.0 to 2.3.0, if a file upload is aborted while using disk storage, leftover orphaned files may remain on disk, consuming disk space over time. This enables an unauthenticated remote attacker to exploit the vulnerability by repeatedly initiating and aborting uploads, potentially leading to exhaustion of available storage. Users are strongly encouraged to upgrade to multer version 2.4.0 or later to mitigate this risk.

References