Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-06-15 | 1 | Patch1 |
| 2026-06-17 | 1 | Disclosure1 |
CVE-2026-5038: multer (Node.js file upload middleware) leaves orphaned temp files on disk when clients abort uploads. Every aborted POST = free DoS. Here's what I'd check Wednesday.
Post summary
The message announces a DoS vulnerability in the multer middleware caused by orphaned temp files on aborted uploads, without providing proof‑of‑concept code, exploitation details, or patch information.
🚨 Medium-severity security fix in multer@2.2.0 and multer@3.0.0-alpha.2 just released! Patches CVE-2026-5038. multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads. https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm
Post summary
The text announces the release of a patch for CVE-2026-5038, detailing a DOS flaw caused by incomplete cleanup of aborted uploads.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | expressjs | multer | - | node.js | - |
| App | expressjs | multer | 3.0.0 | node.js | - |