CVE-2026-77037: multer Denial of Service Vulnerability Due to File Descriptor Leak
Summary
CVE-2026-77037: multer vulnerable to Denial of Service via file descriptor leak on aborted uploads. Affects multer versions >= 2.2.0, < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
multer is a middleware for handling multipart/form-data, primarily used for uploading files in Node.js applications. It provides various storage options, including memory storage and disk storage. The vulnerability in version 2.2.0 arises when using disk storage, where aborted uploads do not close the destination write stream, leading to resource leaks.
Vulnerability Detail
A vulnerability in multer version 2.2.0 allows attackers to exploit the file descriptor leak caused by aborted or truncated multipart uploads. When an upload is aborted, the destination write stream remains open, causing each failed request to leak an open file descriptor. This can lead to a Denial of Service (DoS) as repeated failed uploads exhaust the available file descriptors, potentially crashing the application.
How To Fix
Latest published version: 2.5.0 as of 23 Oct 2026
npm install multer@2.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
npm install multer@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are currently no workarounds available for this vulnerability. The best course of action is to upgrade to the patched version.
Conclusion
The vulnerability in multer version 2.2.0 poses a significant risk of Denial of Service due to file descriptor leaks on aborted uploads. Users are strongly advised to upgrade to version 2.3.0 to mitigate this risk. Regular monitoring of dependencies using tools like Vulert can help maintain application security.
See every vulnerability recorded for multer →
FAQ
The vulnerability can lead to Denial of Service (DoS) by exhausting file descriptors, causing the application to crash.
Versions of multer prior to 2.3.0 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Check your application using the Vulert playground at Vulert Scanner.
While there are no workarounds, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate risks.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for multer.
