CVE-2026-77037: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Impact
A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Other sources
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using multer 2.2.0 with an upload route configured to use the built-in disk storage are exposed. The route must be reachable by a remote attacker.
What does an attacker need to do to trigger the denial of service?
An attacker can repeatedly send aborted, truncated, or malformed multipart uploads before the disk write stream finishes. No privileges or user interaction are required.
What resources can be exhausted?
Each abnormal upload can leave a deleted file's descriptor open and retain its disk blocks until the process exits. Repetition can exhaust file descriptors and disk resources, causing denial of service.
How can the issue be remediated?
Upgrade multer to version 2.3.0. This version closes the destination write stream after abnormal source termination and delays cleanup until the stream has closed.