DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77037: CVE-2026-77037: File Descriptor Leak and Denial of Service in Multer Disk Storage

#security #cve #cybersecurity

CVE-2026-77037: File Descriptor Leak and Denial of Service in Multer Disk Storage

Vulnerability ID: CVE-2026-77037
CVSS Score: 7.5
Published: 2026-09-08

A resource consumption vulnerability exists in the multer library version 2.2.0 when utilizing the disk storage engine. When a remote client aborts or truncates an in-progress file upload, multer removes the partial file from the disk but fails to properly close the active write stream. This behavior leaves the underlying file descriptor open in the operating system, allowing a remote attacker to systematically exhaust the server's file descriptor limits and trigger a Denial of Service.

TL;DR

Unauthenticated remote attackers can exhaust server file descriptors by repeatedly initiating and aborting multipart file uploads in multer v2.2.0, causing a complete denial of service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400 (Uncontrolled Resource Consumption) / CWE-459 (Incomplete Cleanup)
  • Attack Vector: Network / Unauthenticated
  • CVSS v3.1: 7.5 (High)
  • EPSS Score: 0.00347 (Percentile: 27.68%)
  • Impact: Denial of Service (DoS) via File Descriptor Exhaustion
  • Exploit Status: Proof of Concept (PoC) available
  • KEV Status: Not Listed

Affected Systems

  • Node.js applications running multer 2.2.0 configured with diskStorage
  • multer: = 2.2.0 (Fixed in: 2.3.0)

Code Analysis

Commit: eef7444

Fix file descriptor leak on aborted uploads using stream.pipeline and WeakMap stream tracking

Exploit Details

  • GitHub Test Suite: Integration test validating file descriptor count in /proc/self/fd during repeated aborted uploads.

Mitigation Strategies

  • Upgrade the multer package dependency to version 2.3.0 or higher.
  • Implement an upstream reverse proxy (such as Nginx, HAProxy, or Cloudflare) to buffer multipart requests before they reach the Node.js server.
  • Transition the application storage strategy from multer.diskStorage() to multer.memoryStorage() where memory capacity permits.

Remediation Steps:

  1. Open the application package.json file.
  2. Update the multer dependency entry to '^2.3.0'.
  3. Execute 'npm install' or 'yarn install' to pull the updated library.
  4. Restart the Node.js application process in all environments.

References

Read the full report for CVE-2026-77037 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)