CVE-2026-88932: medium-severity vulnerability in multer
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected products
multer · multerRelated CVEs — multer
In the same product, most dangerous first.
CVE-2026-77078HIGHmulter vulnerable to Denial of Service via crafted multipart field namesEPSS 0.5%CVE-2026-77037HIGHmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsEPSS 0.5%CVE-2026-113872HIGHmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownEPSS 0.4%CVE-2026-82333HIGHmulter vulnerable to Denial of Service via oversized array index in field namesEPSS 0.4%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.4%CVE-2026-5079HIGHmulter vulnerable to Denial of Service via deeply nested field namesEPSS 0.3%