GHSA-3pph-fpjx-jg34: Medium severity npm/multer vulnerability
Impact
Multer's diskStorage can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the shared system temporary directory is exhausted. An asynchronous destination or filename widens the window.
Patches
Users should upgrade to 2.4.0 or higher.
Workarounds
None.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
Multerto a version that resolves this vulnerability.Fixed in 2.4.0
Event History
Frequently Asked Questions
Which deployments are exposed to disk exhaustion?
Any route using Multer's diskStorage is exposed if it accepts multipart uploads. An unauthenticated attacker can repeatedly abort upload requests and accumulate orphaned files until the upload directory or shared system temporary directory is exhausted.
What conditions make exploitation easier?
The attacker only needs network access to a multipart-upload route backed by diskStorage; no authentication or user interaction is required. Asynchronous destination or filename handling widens the timing window in which aborted uploads can leave files behind.
Is there a workaround if an upgrade cannot be applied immediately?
No workaround is provided. Upgrade Multer to version 2.4.0 or later.
How can operators tell whether they may already be affected?
Check the disk used by the configured upload directory and any shared system temporary directory for unexpected complete files that are not associated with application-managed uploads. The vulnerable cleanup path leaves no application handle for these orphaned files.