CVE-2026-77037

Analyzed Analyzed - Analysis Complete

Multer Disk Storage Descriptor Leak Leading to DoS

Publication date: 2026-08-28

Last updated on: 2026-09-02

Assigner: openjs

Description

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-77037

Affected Vendors & Products

Vendor	Product	Version / Range
expressjs	multer	2.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-459	The product does not properly "clean up" and remove temporary or supporting resources after they have been used.

Attack-Flow Graph

Executive Summary

This vulnerability affects multer, a Node.js middleware for handling multipart/form-data uploads. In version 2.2.0, if an upload is aborted or truncated before completion, the disk storage engine removes the visible file but leaves the underlying write file descriptor open. This leaks file descriptors and disk blocks, potentially exhausting system resources and causing a denial of service.

Detection Guidance

Detecting this vulnerability requires monitoring for excessive file descriptors or disk space usage by the Node.js process running multer. Check for processes with many open file descriptors using 'lsof -p <PID>' or 'ls -l /proc/<PID>/fd'. Monitor disk space with 'df -h' and look for unexpected growth in the upload directory.

Impact Analysis

An attacker could exploit this by sending repeated aborted or malformed uploads to a server using multer 2.2.0. This would leak file descriptors and disk space, eventually crashing the server or making it unresponsive due to resource exhaustion.

Compliance Impact

This vulnerability primarily causes resource exhaustion leading to denial of service, which may indirectly impact compliance by disrupting data processing or availability. It does not directly violate GDPR or HIPAA but could affect operational integrity of systems handling regulated data.

Mitigation Strategies

Upgrade multer to version 2.3.0 or later immediately. If upgrading is not possible, disable disk storage for uploads or implement strict limits on upload size and duration. Restart the affected Node.js process to clear any leaked file descriptors.

Hi! I’m here to help you understand CVE-2026-77037. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70