Kurz gesagt
- CVE-2026-77037 ist eine Schwachstelle (HOCH (CVSS 7.5)) in multer (expressjs), multer.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.46%, höher als bei 39.7% aller Schwachstellen.
- Abhilfe: auf 2.3.0 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| multer | = 2.2.0
| No fix yet |
| multer npm | ≥ 2.2.0, < 2.3.0
| 2.3.0
|
Description
Impact
A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
NVD description
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free