Description

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-14T09:17:01.630Z",
  "pubdate": "2026-09-14T09:17:01.630Z",
  "executiveSummary": "The Node.js middleware multer contains a vulnerability in its disk storage engine affecting versions 2.2.0 through 2.3.0. The vulnerability allows for an unauthenticated remote Denial of Service (DoS) attack through persistent resource exhaustion.\nSpecifically, when a multipart/form-data upload using disk storage is aborted mid-transmission, the cleanup logic fails to properly reconcile file descriptors or file handles. This results in orphaned files persisting on the host filesystem despite the aborted state of the request.\nBy programmatically initiating and subsequently aborting a high volume of upload requests, an unauthenticated attacker can saturate the available disk capacity of the underlying server. This leads to a denial of service, preventing the application from accepting new data, logging events, or potentially destabilizing the host operating system if partition space is exhausted. The vulnerability is characterized as an improper resource management issue, requiring no specific privileges to trigger, as the endpoint responsible for file uploads is typically exposed to public traffic.",
  "technicalDetails": "The root cause of this vulnerability lies in an asynchronous race condition within the multer disk storage engine's abort handling logic. When a request is aborted, the middleware is designed to trigger a cleanup procedure to remove partially written data segments from the disk. However, in versions 2.2.0 through 2.3.0, the cleanup execution flow fails to account for write operations that are in-flight or buffered by the operating system's filesystem interface at the exact moment the abort signal is processed.\nWhen an upload is aborted, the multer abort handler initiates the deletion of the associated temp file. Due to the lack of proper synchronization or lifecycle tracking of the file writing stream after the abort event, writes initiated by the busboy underlying stream parser may complete after the cleanup routine has already concluded. Consequently, these late-completing writes finalize the file creation or append data to a file that is no longer being tracked by the middleware's internal state machine.\nThe attack flow proceeds as follows: 1. An attacker identifies an endpoint utilizing multer's disk storage. 2. The attacker initiates a large multipart/form-data POST request. 3. The attacker terminates the TCP connection or sends a specific signal that causes the application to trigger the abort logic while the file is still being written to the disk. 4. The application middleware executes its cleanup routine, which fails to account for the ongoing I/O operations. 5. The dangling I/O operation completes, creating an orphaned file that remains on the host filesystem indefinitely.\nBy repeating this process, an attacker can rapidly accumulate thousands of orphaned files. Because these files are not tracked by the application's business logic, they are never deleted by the application's own cleanup tasks. The post-exploitation impact is a definitive resource exhaustion scenario where the storage volume reaches maximum capacity. This effectively denies service to legitimate users attempting to upload files and can lead to secondary failures in any application services dependent on disk writes, such as application logging or session state persistence in local filesystems. This vulnerability is particularly dangerous because it does not require authentication and can be automated with minimal script complexity to achieve a full system DoS."
}