Tóm tắt nhanh
- CVE-2026-77037 là lỗ hổng mức CAO (CVSS 7.5) ảnh hưởng multer (expressjs), multer.
- Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.46%, cao hơn 39.7% các lỗ hổng khác.
- Cách xử lý: cập nhật lên 2.3.0 hoặc mới hơn.
| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|
| multer | = 2.2.0
| Chưa có bản vá |
| multer npm | ≥ 2.2.0, < 2.3.0
| 2.3.0
|
Mô tả
Impact
A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Mô tả của NVD
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí