Is CVE-2026-3304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3304 being exploited in the wild.

How severe is CVE-2026-3304?

High severity, with a CVSS score of 7.5, published 27 February 2026.

Which products and versions are affected?

multer (npm) SEMVER:introduced=0,fixed=2.1.0.

Is there a fix for CVE-2026-3304?

Yes. multer (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-3304 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-3304?

Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup

CVE-2026-3304 · Severity: high · CVSS 7.5 · Published 2026-02-27

Multer is a popular tool used by web applications to handle file uploads. A security flaw in older versions allows an attacker to crash the application or make it unresponsive by sending specially crafted, malformed requests. This can lead to a service outage, preventing legitimate users from accessing the application.

Technologies: multer (npm). Vendors: npm.

Quick answers

Is CVE-2026-3304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3304 being exploited in the wild.
How severe is CVE-2026-3304?: High severity, with a CVSS score of 7.5, published 27 February 2026.
Which products and versions are affected?: multer (npm) SEMVER:introduced=0,fixed=2.1.0.
Is there a fix for CVE-2026-3304?: Yes. multer (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3304 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-3304?: Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.1.0 or later
```
npm install multer@2.1.0
```

Technical details

A Denial of Service (DoS) vulnerability exists in Multer due to incomplete cleanup of resources during the processing of malformed multipart/form-data requests. The root cause is related to 'orphaned files' and incomplete cleanup (CWE-459) when an upload is aborted or fails. An unauthenticated remote attacker can exploit this by sending crafted requests that trigger resource exhaustion or uncontrolled recursion, leading to a service crash. The issue is addressed in version 2.1.0 by improving the middleware's handling of aborted uploads and ensuring temporary files are properly removed.

Affected products

expressjs multer < 2.1.0

Identifiers

CVE-2026-3304
GHSA-xf7r-hgr6-v32p

Timeline

2026-02-27: advisory: GHSA-xf7r-hgr6-v32p published
2026-02-27: patched: Version 2.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.