HighGHSA-q7qp-rjg7-q26mCVE-2026-11387222 Oct · 1 days ago
Source ↗

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown.

Does it affect you?

0/3All must holdTicks stay in this browser
Conditions read by Claude. The sources remain the reference.GitHub advisory

Timeline

22 Oct
27 hfrom publication to Patchwire
  1. Published by GitHub advisory22 Oct
  2. Seen by Patchwire23 Oct
  3. Fix released22 Oct
multer2.5.0

Versions of multer

2.x
safe 2.5.0
AffectedSafe

Packages

multer

Stacks

Express

Related alerts(1)

Same packages

multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multer · 28 Sep

Medium
Conditions not read yet

Source summary

Impact Multer's diskStorage can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the sh

Affected
multer >=2.2.0 <2.4.0
Fixed in
2.4.0
ID
GHSA-3pph-fpjx-jg34
Open the alert