Bug 2532957 (CVE-2026-88932) - CVE-2026-88932 multer: multer: Denial of Service via orphaned disk writes on aborted uploads
Summary: CVE-2026-88932 multer: multer: Denial of Service via orphaned disk writes on ...
Keywords:
Status: NEW
Alias: CVE-2026-88932
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-14 09:01 UTC by OSIDB Bzimport
Modified: 2026-09-15 15:44 UTC (History)
21 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-14 09:01:20 UTC
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.


Note You need to log in before you can comment on or make changes to this bug.