{"vulnerability": "ghsa-3pph-fpjx-jg34", "sightings": [{"uuid": "9546791c-aea8-4762-98d5-0e7dcd7fdc2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-3pph-fpjx-jg34", "type": "seen", "source": "https://gist.github.com/alon710/d40e6730ae74b0abc696ac75cd09960b", "content": "# CVE-2026-88932: CVE-2026-88932: Uncontrolled Resource Consumption (Denial of Service) via orphaned disk writes on aborted uploads in multer\n\n> **CVSS Score:** 5.3\n> **Published:** 2026-09-28\n> **Full Report:** https://cvereports.com/reports/CVE-2026-88932\n\n## Summary\nAn uncontrolled resource consumption vulnerability exists in the multer middleware for Node.js (versions 2.2.0 through 2.3.0) when handling aborted multipart uploads using disk storage. Due to an asynchronous race condition in path resolution, files can become permanently orphaned on disk, leading to storage exhaustion and denial of service.\n\n## TL;DR\nUnauthenticated remote attackers can exhaust server disk space and trigger a denial of service (DoS) by initiating and immediately aborting multipart file uploads before multer completes file path resolution.\n\n## Technical Details\n\n- **CWE ID**: CWE-400, CWE-459\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 5.3 (Medium)\n- **EPSS Score**: 0.00532\n- **Impact**: Denial of Service via Disk Storage Exhaustion\n- **Exploit Status**: No public weaponized exploits available\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- multer (Node.js middleware)\n- **multer**: >= 2.2.0, <= 2.3.0 (Fixed in: `2.4.0`)\n\n## Mitigation\n\n- Upgrade multer to version 2.4.0 or later.\n- Enforce reverse proxy timeouts (such as Nginx client_body_timeout) to drop slow or aborted uploads.\n- Set up an automated system cron task to clean old, untracked files from the upload folder.\n- Migrate to memoryStorage for small uploads to completely bypass filesystem storage exposure.\n\n**Remediation Steps:**\n1. Check package.json for the 'multer' dependency in all active Node.js services.\n2. If the version is between 2.2.0 and 2.3.0, update the dependency reference to '^2.4.0'.\n3. Run 'npm install' or 'yarn install' to retrieve and apply the patched version.\n4. Run regression tests to verify that multipart upload operations perform correctly.\n5. Deploy the updated codebase to testing and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-3pph-fpjx-jg34](https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34)\n- [OpenJS Foundation Security Advisories](https://cna.openjsf.org/security-advisories.html)\n- [Official Patch Commit](https://github.com/expressjs/multer/commit/53337f9713619ef3381ee6b4e541f926dbaac305)\n- [Multer v2.4.0 Release Notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-88932) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-29T00:30:29.000000Z"}]}