VulnSocial

CVE-2026-88932Patch

LOWCVSS 5.3 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-400CWE-459

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-14: 2Patch / Workaround · 2026-09-14: 2Technical Details · 2026-09-14: 109-14
Signal classification1 categories
Patch
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • Ulises Gascón@kom_256
    Patch

    multer@2.4.0 is out 🎉 🔒 Security fix (CVE-2026-88932) ☁️ Google Cloud Functions / Firebase supported via the new streamHandler option 📏 Per-request upload limits ... and much more! https://github.com/expressjs/multer/releases/tag/v2.4.0

    Post summary

    The tweet announces the release of multer v2.4.0, highlighting a security fix for CVE-2026-88932, along with new features such as Google Cloud Functions support and per‑request upload limits.

    00010203
    5.5K followersView on X
  • Ulises Gascón@kom_256
    Patch

    🚨 Medium-severity security fix in multer@2.4.0 just released! Patches CVE-2026-88932: multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34

    Post summary

    The text announces the release of a security fix in [email protected] to address a medium-severity Denial of Service vulnerability (CVE-2026-88932).

    00000198
    5.5K followersView on X

Explore more

Back to dashboard