# OpenJS Foundation Multer vulnerabilities Source: https://junglewise.ai/threats/technologies/multer Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/multer.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in OpenJS Foundation Multer: 0 in the last 7 days and 5 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-88932, was published on 14 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 5 - All time: 14 (0 critical, 0 exploited in the wild) ## About OpenJS Foundation Multer A middleware for Node.js used for handling multipart/form-data, primarily used for uploading files. ## Latest OpenJS Foundation Multer vulnerabilities - [CVE-2026-88932: Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-82333: multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77078: multer Denial of Service via crafted multipart field names](https://junglewise.ai/threats/cve-2026-77078-multer-denial-of-service-via-crafted-multipart-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77063: multer file size limit bypass via async fileFilter race condition](https://junglewise.ai/threats/cve-2026-77063-multer-file-size-limit-bypass-via-async-filefilter-race-condition) (low, CVSS 3.7, published 28 Aug 2026) - [CVE-2026-77037: Express multer file descriptor leak on aborted uploads](https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-5038: Multer Denial of Service via incomplete cleanup in diskStorage](https://junglewise.ai/threats/cve-2026-5038-multer-denial-of-service-via-incomplete-cleanup-in-diskstorage) (medium, CVSS 5.3, published 15 Jun 2026) - [CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names](https://junglewise.ai/threats/cve-2026-5079-openjs-multer-denial-of-service-via-deeply-nested-field-names) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-3520: expressjs Multer denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-3520-expressjs-multer-denial-of-service-via-uncontrolled-recursion) (high, CVSS 7.5, published 4 Mar 2026) - [CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup](https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-2359: expressjs multer denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-2359-expressjs-multer-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2025-7338: Multer denial of service via unhandled exception](https://junglewise.ai/threats/cve-2025-7338-multer-denial-of-service-via-unhandled-exception) (low, CVSS 3.1, published 17 Jul 2025) - [CVE-2025-48997: Multer Denial of Service via unhandled exception](https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception) (medium, CVSS 4, published 5 Jun 2025) - [CVE-2025-47944: Multer denial of service from malformed multipart requests](https://junglewise.ai/threats/cve-2025-47944-multer-denial-of-service-from-malformed-multipart-requests) (low, CVSS 3.1, published 19 May 2025) - [CVE-2025-47935: Multer memory leak denial of service via unclosed streams](https://junglewise.ai/threats/cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams) (low, CVSS 3.1, published 19 May 2025) ## Most severe OpenJS Foundation Multer vulnerabilities - [CVE-2026-3520: expressjs Multer denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-3520-expressjs-multer-denial-of-service-via-uncontrolled-recursion) (high, CVSS 7.5, published 4 Mar 2026) - [CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup](https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-2359: expressjs multer denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-2359-expressjs-multer-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-77037: Express multer file descriptor leak on aborted uploads](https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-82333: multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77078: multer Denial of Service via crafted multipart field names](https://junglewise.ai/threats/cve-2026-77078-multer-denial-of-service-via-crafted-multipart-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names](https://junglewise.ai/threats/cve-2026-5079-openjs-multer-denial-of-service-via-deeply-nested-field-names) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-88932: Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-5038: Multer Denial of Service via incomplete cleanup in diskStorage](https://junglewise.ai/threats/cve-2026-5038-multer-denial-of-service-via-incomplete-cleanup-in-diskstorage) (medium, CVSS 5.3, published 15 Jun 2026) - [CVE-2025-48997: Multer Denial of Service via unhandled exception](https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception) (medium, CVSS 4, published 5 Jun 2025) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 4 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other OpenJS Foundation technologies - [OpenJS Foundation Node.js](https://junglewise.ai/threats/technologies/openjs-foundation-node-js): 18 vulnerabilities - [OpenJS Foundation Undici](https://junglewise.ai/threats/technologies/openjs-foundation-undici): 12 vulnerabilities - [OpenJS Foundation Electron](https://junglewise.ai/threats/technologies/openjs-foundation-electron): 11 vulnerabilities - [OpenJS Foundation Morgan](https://junglewise.ai/threats/technologies/morgan): 4 vulnerabilities - [OpenJS Foundation Body-Parser](https://junglewise.ai/threats/technologies/body-parser): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenJS Foundation Multer vulnerabilities", https://junglewise.ai/threats/technologies/multer, 12 November 2026.