Executive brief
Multer is a popular tool used by web applications to handle file uploads. A security flaw in older versions allows an attacker to crash the application or make it unresponsive by sending specially crafted, malformed requests. This can lead to a service outage, preventing legitimate users from accessing the application.
Technical details
A Denial of Service (DoS) vulnerability exists in Multer due to incomplete cleanup of resources during the processing of malformed multipart/form-data requests. The root cause is related to 'orphaned files' and incomplete cleanup (CWE-459) when an upload is aborted or fails. An unauthenticated remote attacker can exploit this by sending crafted requests that trigger resource exhaustion or uncontrolled recursion, leading to a service crash. The issue is addressed in version 2.1.0 by improving the middleware's handling of aborted uploads and ensuring temporary files are properly removed.
Affected products
- expressjs multer < 2.1.0
Timeline
- 2026-02-27: advisory: GHSA-xf7r-hgr6-v32p published
- 2026-02-27: patched: Version 2.1.0 released
References
- https://cna.openjsf.org/security-advisories.html
- https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee
- https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p
- https://www.cve.org/CVERecord?id=CVE-2026-3304
- https://access.redhat.com/errata/RHSA-2026:6174
- https://access.redhat.com/errata/RHSA-2026:6802
- https://access.redhat.com/security/cve/CVE-2026-3304