Is CVE-2026-77037 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77037 being exploited in the wild.

How severe is CVE-2026-77037?

High severity, with a CVSS score of 7.5, published 28 August 2026.

Which products and versions are affected?

multer (npm) SEMVER:introduced=2.2.0,fixed=2.3.0.

Is there a fix for CVE-2026-77037?

Yes. multer (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77037 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-77037?

Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77037: Express multer file descriptor leak on aborted uploads

CVE-2026-77037 · Severity: high · CVSS 7.5 · Published 2026-08-28

Multer is a popular Node.js middleware for handling file uploads in web applications. Version 2.2.0 contains a resource leak that allows attackers to exhaust file descriptors by repeatedly sending aborted or truncated multipart uploads. When an upload is abandoned before completion, the destination write stream is not properly closed, leaving open file handles and disk blocks in use until the process exits. An attacker can trigger many failed uploads to systematically exhaust the server's file descriptor capacity, causing the application to crash or become unable to open new files.

Technologies: multer (npm). Vendors: npm.

Quick answers

Is CVE-2026-77037 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77037 being exploited in the wild.
How severe is CVE-2026-77037?: High severity, with a CVSS score of 7.5, published 28 August 2026.
Which products and versions are affected?: multer (npm) SEMVER:introduced=2.2.0,fixed=2.3.0.
Is there a fix for CVE-2026-77037?: Yes. multer (npm): upgrade to 2.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77037 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-77037?: Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.3.0 or later
```
npm install multer@2.3.0
```

Technical details

The vulnerability is a resource leak (CWE-400: Uncontrolled Resource Consumption; CWE-459: Incomplete Cleanup) in multer's diskStorage implementation. When handling multipart uploads, if the request is aborted or truncated before the upload completes, the write stream opened to the destination file is not properly closed. This leaves open file descriptors and retains allocated disk blocks until the Node.js process exits. The vulnerability is triggered via network requests (no authentication or user interaction required) and affects all applications using multer 2.2.0 with disk storage. An attacker can send repeated aborted uploads to exhaust the system's open file descriptor limit, resulting in denial of service. The fix is available in version 2.3.0, which ensures write streams are closed even when uploads are aborted.

Affected products

Express.js multer 2.2.0

Identifiers

CVE-2026-77037
GHSA-qfvm-cv95-jqjf

Timeline

2026-08-28: disclosed: Vulnerability published to NVD
2026-09-08: advisory: GitHub Advisory GHSA-qfvm-cv95-jqjf published
2026-08-28: patched: Fix released in version 2.3.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.