By weakness (CWE)

CWE-459: related vulnerabilities

CVEs classified under CWE-459. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

2 published vulnerabilities

• CVE-2026-5038MEDIUM 5.3

  multer, a popular Node.js middleware for handling file uploads, has a resource exhaustion vulnerability affecting versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1. When a multipart upload is aborted or arrives malformed, the library fails to clean up temporary partial files from disk. An unauthenticated attacker can repeatedly trigger these failed uploads to consume disk space until the server runs out, causing a denial of service. No special application code flaws are needed—the vulnerability is inherent to how multer manages stream cleanup.

• CVE-2026-53867MEDIUM 4.3

  Capgo versions prior to 12.128.2 do not properly clean up user profile images from storage when those images are replaced or deleted. This means old image files remain accessible on the backend server even after users think they've removed them. An attacker with a user account can leverage previously shared or discovered image URLs to retrieve these orphaned files, potentially accessing private user photos or other sensitive image data that should have been deleted.