CVE-2026-88932— multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Quick assessment
Affected
multer multer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
multer 是一个用于处理 multipart/form-data 文件上传的 Node.js 中间件。在 2.2.0 到 2.3.0 版本中，当使用磁盘存储（disk storage）的上传请求在上传过程中被中止时，如果在 multer 执行中止清理逻辑之后仍有文件写入完成，这些文件将不会被删除，导致每次中止的上传都会在磁盘上遗留一个孤立文件（orphaned file）。远程未认证的攻击者可以通过反复发起并中止上传请求，不断积累孤立文件，从而耗尽磁盘空间，导致服务不可用（拒绝服务，Denial of Serv
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-88932
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Source: CVE Program / CVE List V5
Vulnerability Description
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-88932
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-88932
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-88932 (1)
IV. Related Vulnerabilities
Same product: multer
-
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array i -
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart -
CVE-2026-77063
multer vulnerable to file size limit bypass via async fileFi -
CVE-2026-77037
multer vulnerable to Denial of Service via file descriptor l -
CVE-2026-5038
multer vulnerable to Denial of Service via incomplete cleanu
Same vendor: multer
-
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array i -
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart -
CVE-2026-77063
multer vulnerable to file size limit bypass via async fileFi -
CVE-2026-77037
multer vulnerable to Denial of Service via file descriptor l -
CVE-2026-5038
multer vulnerable to Denial of Service via incomplete cleanu
Same weakness: CWE-400
-
CVE-2026-90582
evanchiu serverless-todo API Todo Endpoint index.js saveTodo -
CVE-2026-90554
vLLM before 0.28.0 Denial of Service via audio extraction -
CVE-2026-50018
Hoverfly: Denial of Service via Goroutine Leak in Remote Pos -
CVE-2026-54135
AirSane has a Remote Denial of Service (OOM) via Unvalidated -
CVE-2026-68497
jackson-databind: unbounded numeric parse in Duration and XM
V. Comments for CVE-2026-88932
No comments yet