GHSA-qfvm-cv95-jqjf: High severity npm/multer vulnerability
Impact
A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Compensating control
Mitigate DoS risk by monitoring and limiting repeated failed multipart uploads (since each failed request can leak an open file descriptor and retain disk blocks until the process exits).
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
All applications using multer diskStorage are affected. Applications that do not use diskStorage are not identified as affected by the provided advisory.
What does an attacker need to do to trigger the resource leak?
An attacker can abort or truncate multipart uploads before they finish. Repeated failed upload requests leak open file descriptors and retain disk blocks until the process exits, potentially exhausting available file descriptors.
Is there a workaround if an immediate upgrade is not possible?
No workaround is provided. The stated remediation is to upgrade multer to version 2.3.0.