Executive brief
Multer is a popular Node.js middleware for handling file uploads in web applications. Version 2.2.0 contains a resource leak that allows attackers to exhaust file descriptors by repeatedly sending aborted or truncated multipart uploads. When an upload is abandoned before completion, the destination write stream is not properly closed, leaving open file handles and disk blocks in use until the process exits. An attacker can trigger many failed uploads to systematically exhaust the server's file descriptor capacity, causing the application to crash or become unable to open new files.
Technical details
The vulnerability is a resource leak (CWE-400: Uncontrolled Resource Consumption; CWE-459: Incomplete Cleanup) in multer's diskStorage implementation. When handling multipart uploads, if the request is aborted or truncated before the upload completes, the write stream opened to the destination file is not properly closed. This leaves open file descriptors and retains allocated disk blocks until the Node.js process exits. The vulnerability is triggered via network requests (no authentication or user interaction required) and affects all applications using multer 2.2.0 with disk storage. An attacker can send repeated aborted uploads to exhaust the system's open file descriptor limit, resulting in denial of service. The fix is available in version 2.3.0, which ensures write streams are closed even when uploads are aborted.
Affected products
- Express.js multer 2.2.0
Timeline
- 2026-08-28: disclosed: Vulnerability published to NVD
- 2026-09-08: advisory: GitHub Advisory GHSA-qfvm-cv95-jqjf published
- 2026-08-28: patched: Fix released in version 2.3.0