CVE-2026-77037: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using multer 2.2.0 with an upload route configured to use the built-in disk storage are exposed. The route must be reachable by a remote attacker.
What does an attacker need to do to trigger the denial of service?
An attacker can repeatedly send aborted, truncated, or malformed multipart uploads before the disk write stream finishes. No privileges or user interaction are required.
What resources can be exhausted?
Each abnormal upload can leave a deleted file's descriptor open and retain its disk blocks until the process exits. Repetition can exhaust file descriptors and disk resources, causing denial of service.
How can the issue be remediated?
Upgrade multer to version 2.3.0. This version closes the destination write stream after abnormal source termination and delays cleanup until the stream has closed.