CVE-2026-77037: falha de alta gravidade em multer
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 0.5%
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
multer · multerCVEs relacionadas — multer
No mesmo produto, das mais perigosas para as menos.
CVE-2026-88932MEDIUMmulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsEPSS 0.5%CVE-2026-77078HIGHmulter vulnerable to Denial of Service via crafted multipart field namesEPSS 0.5%CVE-2026-113872HIGHmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownEPSS 0.4%CVE-2026-82333HIGHmulter vulnerable to Denial of Service via oversized array index in field namesEPSS 0.4%CVE-2026-5038MEDIUMmulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsEPSS 0.4%CVE-2026-5079HIGHmulter vulnerable to Denial of Service via deeply nested field namesEPSS 0.3%