# CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup

Source: https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-3304 · Severity: high · CVSS 7.5 · Published 2026-02-27

Multer is a popular tool used by web applications to handle file uploads. A security flaw in older versions allows an attacker to crash the application or make it unresponsive by sending specially crafted, malformed requests. This can lead to a service outage, preventing legitimate users from accessing the application.

Technologies: [multer (npm)](https://junglewise.ai/threats/technologies/npm-multer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-3304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-3304 being exploited in the wild.

**How severe is CVE-2026-3304?** High severity, with a CVSS score of 7.5, published 27 February 2026.

**Which products and versions are affected?** multer (npm) SEMVER:introduced=0,fixed=2.1.0.

**Is there a fix for CVE-2026-3304?** Yes. multer (npm): upgrade to 2.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-3304 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-3304?** Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- multer (npm): upgrade to 2.1.0 or later

  ```sh
  npm install multer@2.1.0
  ```


## Technical details

A Denial of Service (DoS) vulnerability exists in Multer due to incomplete cleanup of resources during the processing of malformed multipart/form-data requests. The root cause is related to 'orphaned files' and incomplete cleanup (CWE-459) when an upload is aborted or fails. An unauthenticated remote attacker can exploit this by sending crafted requests that trigger resource exhaustion or uncontrolled recursion, leading to a service crash. The issue is addressed in version 2.1.0 by improving the middleware's handling of aborted uploads and ensuring temporary files are properly removed.

## Affected products

- expressjs multer < 2.1.0

## Identifiers

- CVE-2026-3304
- GHSA-xf7r-hgr6-v32p

## Timeline

- 2026-02-27: advisory: GHSA-xf7r-hgr6-v32p published
- 2026-02-27: patched: Version 2.1.0 released

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee](https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee)
- [https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p](https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p)
- [https://www.cve.org/CVERecord?id=CVE-2026-3304](https://www.cve.org/CVERecord?id=CVE-2026-3304)
- [https://access.redhat.com/errata/RHSA-2026:6174](https://access.redhat.com/errata/RHSA-2026:6174)
- [https://access.redhat.com/errata/RHSA-2026:6802](https://access.redhat.com/errata/RHSA-2026:6802)
- [https://access.redhat.com/security/cve/CVE-2026-3304](https://access.redhat.com/security/cve/CVE-2026-3304)

## Related threats

- [multer denial of service in asynchronous fileFilter after request teardown](https://junglewise.ai/threats/cve-2026-113872-multer-is-a-middleware-for-node-js-that-handles-multipart-form)
- [Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes)
- [multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names)
- [multer Denial of Service via crafted multipart field names](https://junglewise.ai/threats/cve-2026-77078-multer-denial-of-service-via-crafted-multipart-field-names)
- [multer file size limit bypass via async fileFilter race condition](https://junglewise.ai/threats/cve-2026-77063-multer-file-size-limit-bypass-via-async-filefilter-race-condition)