CVE-2026-5038: fallo de gravedad media en multer
multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.4%
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to
the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required.
Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path.
Workarounds: None.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
multer · multerCVEs relacionadas — multer
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2026-77078HIGHmulter vulnerable to Denial of Service via crafted multipart field namesEPSS 0.5%CVE-2026-77037HIGHmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsEPSS 0.5%CVE-2026-113872HIGHmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownEPSS 0.4%CVE-2026-82333HIGHmulter vulnerable to Denial of Service via oversized array index in field namesEPSS 0.4%CVE-2026-5079HIGHmulter vulnerable to Denial of Service via deeply nested field namesEPSS 0.3%