Incomplete cleanup in multer - CVE-2026-77037
Published: September 2, 2026
Vulnerability identifier: #VU146781
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77037
CWE-ID: CWE-459
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to incomplete cleanup in diskStorage when handling aborted or truncated multipart uploads. A remote attacker can abort or truncate multipart upload requests to cause a denial of service.
Each failed request can leak an open file descriptor and retain its disk blocks until the process exits. Only applications using disk storage are vulnerable.
Affected software
multer
How to mitigate CVE-2026-77037
Install security update from vendor's website.
multer - update to 2.3.0