CVE-2026-77037: fallo de gravedad alta en multer
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.5%
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
multer · multerCVEs relacionadas — multer
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2026-77078HIGHmulter vulnerable to Denial of Service via crafted multipart field namesEPSS 0.5%CVE-2026-113872HIGHmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownEPSS 0.4%CVE-2026-82333HIGHmulter vulnerable to Denial of Service via oversized array index in field namesEPSS 0.4%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.4%CVE-2026-5079HIGHmulter vulnerable to Denial of Service via deeply nested field namesEPSS 0.3%