CVE-2026-77037

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0

Description When using the disk storage engine for handling multipart/form-data, the software fails to close the underlying write file descriptor if an upload is aborted or truncated before the write stream finishes. Although the visible file is removed, the open descriptor remains, causing a leak of file descriptors and disk blocks. A remote attacker can exploit this by sending repeated aborted or malformed multipart uploads to an upload route, potentially exhausting system resources and leading to a denial of service.

Recommendations Upgrade to version 2.3.0.