{"id":"CVE-2026-77037","aliases":["CLSA-2026-1791371658","DEBIAN-CVE-2026-77037","EUVD-2026-67928","GHSA-qfvm-cv95-jqjf","ROOT-APP-NPM-CVE-2026-77037"],"status":"published","title":"multer vulnerable to Denial of Service via file descriptor leak on aborted uploads","description":"multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00457,"percentile":0.39902,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-459"],"published":"2026-08-28T19:44:23Z","modified":"2026-11-02T18:00:45Z","fixes":[{"ecosystem":"npm","package":"multer","fixed_in":["2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-multer","fixed_in":["2.4.0+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"multer","fixed_in":["2.2.0-aikido.1","2.2.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/multer","fixed_in":["2.2.0-root.io.1","2.2.0-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"last_affected":"2.2.0"},{"fixed":"2.3.0"}]}],"versions":["2.2.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-tuxcare.0"},{"fixed":"2.2.0-tuxcare.3"}]}],"versions":["2.2.0","2.2.0-tuxcare.1","2.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:14","package":"node-multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+~cs3.2.0-1"}]}],"versions":["2.2.0+~cs3.1.0-1","2.2.0+~cs3.1.0-2","2.2.0+~cs3.2.0-1"]},{"source":"osv","ecosystem":"npm","package":"multer","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.3.0"}]}],"versions":["2.2.0"]},{"source":"osv","ecosystem":"Root:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-aikido.1"},{"fixed":"2.2.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0-root.io.1"},{"fixed":"2.2.0-root.io.2"}]}]}],"products":[{"vendor":"expressjs","product":"multer"},{"vendor":"multer","product":"multer"}],"references":[{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf","tags":["Vendor Advisory","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77037","tags":["advisory"]},{"url":"https://github.com/expressjs/multer/commit/eef74440b491ef0f976f3d25895e8089ae495df0","tags":["web"]},{"url":"https://github.com/expressjs/multer/releases/tag/v2.3.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qfvm-cv95-jqjf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77037.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77037","tags":["advisory"]},{"url":"https://github.com/expressjs/multer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77037","title":"multer vulnerable to Denial of Service via file descriptor leak on aborted uploads","description":"multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T19:44:23.501Z","modified":"2026-08-31T18:41:28.652Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-459"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-67928","description":"multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T19:44:23Z","modified":"2026-08-31T18:41:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:20.215322Z"}],"ghsa":[{"id":"GHSA-qfvm-cv95-jqjf","title":"multer vulnerable to Denial of Service via file descriptor leak on aborted uploads","description":"### Impact\n\nA vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using `diskStorage`, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.\n\n### Patches\n\nUsers should upgrade to `2.3.0`.\n\n### Workarounds\n\nNone.","status":"published","published":"2026-09-08T21:29:51Z","modified":"2026-09-08T21:29:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-459"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-77037","description":"multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T22:16:53.627Z","modified":"2026-09-02T14:47:21.14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-459"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-77037","title":"multer vulnerable to Denial of Service via file descriptor leak on aborted uploads","description":"multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T19:44:23.501Z","modified":"2026-10-28T02:30:57.068227769Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-459"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-77037","description":"multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T22:16:53.627Z","modified":"2026-11-02T18:00:45.126479477Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:03:20.122208Z"},{"id":"GHSA-qfvm-cv95-jqjf","title":"multer vulnerable to Denial of Service via file descriptor leak on aborted uploads","description":"### Impact\n\nA vulnerability in multer `2.2.0` allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using `diskStorage`, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.\n\n### Patches\n\nUsers should upgrade to `2.3.0`.\n\n### Workarounds\n\nNone.","status":"published","published":"2026-09-08T21:29:51Z","modified":"2026-09-08T21:45:04.619155871Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-459"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"CLSA-2026-1791371658","title":"TuxCare security update for multer (2 CVEs)","description":"TuxCare rebuilt multer to address 2 CVEs. Fixed in 2.2.0-tuxcare.3.","status":"published","published":"2026-10-07T11:14:18Z","modified":"2026-10-15T09:47:39.590494028Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-APP-NPM-CVE-2026-77037","title":"CVE-2026-77037 in multer - Patched by Root","description":"Root has patched CVE-2026-77037 in the multer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-29T18:47:25Z","modified":"2026-10-29T19:15:03.153137065Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}