CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
Remote attackers can exhaust disk space by repeatedly aborting uploads, causing denial of service in applications using this Node.js library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-88932?
CVE-2026-88932 is a medium-severity denial of service vulnerability in multer, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.
Which versions are affected by CVE-2026-88932?
2 open source packages ship an affected version, including multer.
| Package | Affected | Fixed in |
|---|---|---|
multer npm | From 2.2.0 | 2.4.0 |
multer npm | From 2.2.0 | 2.4.0 |
How do I fix CVE-2026-88932?
Upgrade multer to 2.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-88932 being exploited?
There is no known exploitation of CVE-2026-88932 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1790673440, ECHO-6a35-9e34-bdfe, GHSA-3pph-fpjx-jg34, MINI-4pg4-4qqm-vf96, MINI-76h6-x6cc-7qhj, MINI-cgj7-7vv5-fc67 and 1 more.