CVE-2026-77037

A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can exploit a file descriptor leak by sending repeated aborted or malformed multipart uploads. This can exhaust system resources, leading to a denial of service (DoS) for the affected application.

A file descriptor leak vulnerability was found in multer, a Node.js middleware for handling multipart/form-data. When using multer's built-in diskStorage engine, aborted or truncated uploads cause the disk storage engine to remove the visible file but fail to close the underlying write file descriptor. A remote attacker able to reach an upload route can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust system resources and cause a denial of service. This vulnerability only affects applications using multer's diskStorage; applications using memoryStorage or custom storage engines are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade to multer 2.3.0 or later, which properly closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed.