CVE-2026-5038: multer Denial of Service via Orphaned Upload Files

Technical summary

The vulnerability stems from improper stream lifecycle management in multer's diskStorage implementation. When a readable stream is piped to an fs.WriteStream, the Readable.pipe() call does not automatically propagate the destroy signal downstream in all failure modes. During an aborted multipart upload (such as a client disconnect or malformed Content-Length header), the write stream is never destroyed or cleaned up. Orphaned partial files accumulate on the file system. Because disk I/O operations are relatively fast compared to network transmission, an attacker can sustain a high rate of aborted uploads to exhaust available disk space, triggering application errors or complete unavailability.

Business impact

Applications using affected multer versions will experience progressive disk exhaustion leading to service degradation or outage. File upload functionality fails, application logs fill with I/O errors, and in constrained environments (containerized deployments, cloud instances with fixed storage), the entire application may become unavailable within hours of sustained attack. Recovery requires manual cleanup of orphaned files and server restart. Organizations relying on multer for user file submissions, document handling, or media ingestion face reputational and revenue impact proportional to upload traffic.

Affected systems

multer 2.0.0-alpha.1 through 2.1.1 (stable 2.x line) and 3.0.0-alpha.1 (early prerelease 3.x) are vulnerable when diskStorage is configured. Applications using multer with memory storage or custom storage implementations are not affected. The vulnerability applies to any Node.js/Express application that accepts multipart uploads and has not upgraded to patched versions.

Exploitability

This vulnerability is trivial to exploit. An attacker requires no authentication, no special upload content, and no application-level bugs. Simple HTTP requests with incomplete multipart payloads (e.g., early connection termination, invalid headers) trigger orphaned file creation. The attack is network-accessible and scales horizontally—a single attacker or botnet can sustain high request rates to exhaust disk resources. There is no user interaction required. Automated scanning and exploitation are straightforward.

Remediation

Upgrade immediately to multer 2.2.0 (for the 2.x stable line) or 3.0.0-alpha.2 (for the 3.x prerelease). Both patched versions implement stream tracking and destroy all in-flight write streams on the abort path, eliminating orphaned files. If immediate upgrade is infeasible, no reliable workaround exists—application-level stream management cannot fully compensate. Consider temporarily disabling file upload features or rate-limiting upload endpoints as a temporary mitigation only.

Patch guidance

Verify your current multer version using `npm list multer` or check package-lock.json. If running 2.0.0-alpha.1 through 2.1.1, upgrade to 2.2.0 via `npm update multer` or `npm install [email protected]`. If running 3.0.0-alpha.1, upgrade to 3.0.0-alpha.2. Test file upload and abort scenarios in a staging environment to confirm cleanup behavior. Review any custom middleware or stream-handling code that may interact with multer's internal streams. Restart applications after dependency update.

Detection guidance

Monitor disk usage trends on application servers running multer, particularly spikes during periods of failed or aborted uploads. Check file system logs for rapid creation of temporary files in multer's designated upload directory (often /tmp or a configured path). Correlate upload endpoint access logs with disk growth—sustained GET or POST requests to upload endpoints without successful completions indicate attack activity. Implement alerts on disk utilization thresholds and watch for accumulation of partial or zero-byte files with recent modification times. Log all multipart upload failures and abort events at the application level.

Why prioritize this

Although CVSS 5.3 (MEDIUM) reflects limited scope, this vulnerability poses significant operational risk. Denial of service attacks are particularly damaging in production environments, and disk exhaustion can cascade to affect other services sharing the same storage. The vulnerability is trivial to exploit, requires no privileges, and can be triggered by any untrusted source sending multipart uploads. Organizations with externally facing file upload endpoints should prioritize patching within days, not weeks. Internal-only upload services can be deprioritized slightly but should not be deferred indefinitely.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects a network-accessible denial of service with low complexity and no privileges required, but limited scope (availability only—no confidentiality or integrity impact). The score does not capture the ease of exploitation or the operational criticality of file upload functionality in many applications. Organizations should weigh their reliance on multer-based uploads and their tolerance for downtime when assessing true risk. High-availability deployments or user-facing services should treat this as HIGH priority despite the MEDIUM CVSS rating.

Frequently asked questions