CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Remote attackers can cause denial of service by leaking file descriptors through aborted uploads in the multer Node.js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-77037?
CVE-2026-77037 is a high-severity denial of service vulnerability in multer, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
Which versions are affected by CVE-2026-77037?
2 open source packages ship an affected version, including multer. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
multer npm | From 2.2.0 | 2.3.0 |
multer npm | From 2.2.0 | 2.3.0 |
Products include Expressjs Multer.
How do I fix CVE-2026-77037?
Upgrade multer to 2.3.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77037 being exploited?
There is no known exploitation of CVE-2026-77037 in the wild and no public exploit code.
Other vulnerabilities in multer
- CVE-2026-3520 Multer vulnerable to Denial of Service via uncontrolled recursion
- CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion
- CVE-2026-3304 Multer vulnerable to Denial of Service via incomplete cleanup
- CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names
- CVE-2026-82333 multer vulnerable to Denial of Service via oversized array index in field names
Sources
Also known as CLEANSTART-2026-FL31230, ECHO-65aa-dfa0-c380, GHSA-qfvm-cv95-jqjf, MINI-3jg4-mcf8-7wm3, MINI-63c9-mv84-4vcf, MINI-q3rr-c25j-h586 and 1 more.