~ / search / GHSA-3p4h-7m6x-2hcm

GHSA-3p4h-7m6x-2hcm

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-5038

Packages

EcosystemPackageAffectedFixed in
npm multer >= 2.0.0-alpha.1, < 2.2.0 2.2.0
npm multer >= 3.0.0-alpha.1, < 3.0.0-alpha.2 3.0.0-alpha.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact A vulnerability in Multer allows an attacker to trigger a Denial of Service (DoS) by aborting or sending malformed multipart uploads, causing orphaned partial files to accumulate on disk when using diskStorage. ### Patches Users should upgrade to `2.2.0`, `3.0.0-alpha.2` or higher ### Workarounds None

References

External links from the advisory. They lead to third-party sites.