CVE-2026-88932: Multer Denial of Service via Orphaned Disk Writes on Aborted Uploads
Summary
CVE-2026-88932: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads. Affects multer versions >= 2.2.0, < 2.4.0. Fixed in 2.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Multer is a middleware for handling multipart/form-data, primarily used for uploading files in Node.js applications. It provides various storage options, including disk storage, which allows files to be saved directly to the server's filesystem. This functionality is crucial for applications that require file uploads, but it also introduces potential vulnerabilities if not managed correctly.
Vulnerability Detail
The vulnerability arises from Multer's diskStorage feature, which can leave orphaned files on the disk when a multipart upload is aborted before the storage engine assigns a file path. This issue is a partial fix of CVE-2026-5038, where the cleanup only removes in-flight uploads that already have a path. If an upload is aborted in the brief window before a path is assigned, the file is written to disk without a mechanism to remove it, leading to potential Denial of Service (DoS) as an attacker can send multiple aborted requests, filling up the disk space with orphaned files.
How To Fix
Latest published version: 2.5.0 as of 23 Oct 2026
npm install multer@2.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.4.0
This is the first release that contains the fix.
npm install multer@2.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no effective workarounds available to mitigate this vulnerability without upgrading to the patched version.
Conclusion
In summary, CVE-2026-88932 affects Multer's diskStorage feature, allowing for Denial of Service through orphaned files on aborted uploads. Users are strongly advised to upgrade to version 2.4.0 or higher to mitigate this risk. Regular monitoring using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for multer →
FAQ
The vulnerability can lead to Denial of Service (DoS) by allowing an attacker to fill up the disk space with orphaned files from aborted uploads.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Multer versions prior to 2.4.0 are affected by this vulnerability.
Currently, there are no workarounds available to prevent orphaned files without upgrading to the patched version.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for multer.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
