CVE-2026-88932
Received Received - Intake

Disk Space Exhaustion in Multer File Uploads

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: openjs

Description
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-88932
EUVD
EUVD-2026-77332

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects multer, a Node.js middleware for handling file uploads. When a file upload is aborted before the storage engine assigns a file path, multer fails to clean up the partially written file. This leaves orphaned files on disk that accumulate over time. An attacker can exploit this by repeatedly starting and aborting uploads to exhaust disk space, causing a denial of service.

Detection Guidance

To detect orphaned files from aborted uploads, monitor the upload directory and system temporary directory for unexpected files. Check for files with unusual timestamps or names. Use commands like 'find /tmp -type f -mtime -1' to list recently modified files or 'ls -la /path/to/upload/dir' to inspect directory contents.

Impact Analysis

This vulnerability can impact you by allowing remote unauthenticated attackers to fill up your disk space through repeated aborted uploads. This can lead to system slowdowns, crashes, or service unavailability due to lack of storage. It primarily affects availability rather than confidentiality or integrity.

Compliance Impact

This vulnerability primarily causes disk space exhaustion due to orphaned files from aborted uploads, which could lead to service unavailability. While not directly violating GDPR or HIPAA, such disruptions may impact data processing integrity or availability requirements under these regulations. Organizations handling sensitive data (e.g., personal health or financial information) could face compliance risks if the DoS disrupts critical systems.

Mitigation Strategies

Upgrade multer to version 2.4.0 or later immediately to patch the vulnerability. If upgrading is not possible, consider switching to memory storage instead of disk storage for uploads to avoid orphaned files. Regularly monitor disk space and clean up orphaned files manually.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88932. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart