CVE-2026-103937: Misskey File Upload DoS Vulnerability

CVE-2026-103937 Overview

CVE-2026-103937 is a resource exhaustion vulnerability in Misskey, an open-source federated social media platform. The flaw affects versions 13.0.0 through 2025.4.1 and 2025.5.0 through versions prior to 2026.7.0. Cleanup processing does not consistently execute during file uploads, leaving temporary files on disk and file descriptors open. Attackers can send repeated upload requests to exhaust storage space or file descriptor limits on the server. The condition triggers regardless of whether ActivityPub federation is enabled, so standalone deployments remain exposed. The issue is categorized as improper resource shutdown or release [CWE-459].

Critical Impact

Unauthenticated remote attackers can exhaust storage or file descriptors through repeated file uploads, denying service to legitimate users of the Misskey instance.

Affected Products

• Misskey versions 13.0.0 through 2025.4.1
• Misskey versions 2025.5.0 through versions prior to 2026.7.0
• Fixed in Misskey version 2026.7.0

Discovery Timeline

• 2026-10-13 - CVE-2026-103937 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-103937

Vulnerability Analysis

The vulnerability resides in the Misskey backend multipart API handler at packages/backend/src/server/api/ApiCallService.ts. When processing uploaded files, the handler creates a temporary file through createTemp() and streams the multipart body to disk using stream.pipeline. The original code only invoked the cleanup() callback for specific error paths, such as a truncated file exceeding the size limit. Other error conditions, including stream failures or exceptions during downstream validation, left the temporary file on disk and the write stream descriptor unreleased.

Repeated upload attempts magnify the leak. Each failed or interrupted request consumes additional inodes, disk space, and file descriptors until the operating system refuses new allocations. The service then stops accepting legitimate uploads and may become fully unresponsive.

Root Cause

The root cause is missing exception handling around the temporary file lifecycle. The pre-patch code performed stream.pipeline and subsequent processing outside a try/finally block, so cleanup never ran if an error occurred after the temporary file was created but before the explicit cleanup paths were reached.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker repeatedly posts multipart file uploads to a vulnerable Misskey API endpoint. Each request leaves residual state. Sustained traffic exhausts storage or the per-process file descriptor table, producing denial of service.

// Patch excerpt from packages/backend/src/server/api/ApiCallService.ts
// Source: https://github.com/misskey-dev/misskey/commit/3f28489fb856e6e07a16290f3ea1e1261572b527

			reply.send();
			return;
		}
		const [path, cleanup] = await createTemp();

		try {
			await stream.pipeline(multipartData.file, fs.createWriteStream(path));

			// Size-limit and downstream handling now live inside try{}
			// so the finally{} block (added in the full patch) always
			// invokes cleanup() to remove the temp file.
		} catch (err) {
			cleanup();
			throw err;
		}

The fix wraps the pipeline and downstream processing in a try block so cleanup runs on every exit path. See the GitHub commit and Pull Request #17750 for the full change set.

Detection Methods for CVE-2026-103937

Indicators of Compromise

• Growing count of files in the Misskey temporary upload directory that are not cleaned up after request completion.
• Rising open file descriptor counts for the Misskey Node.js process observed through lsof -p <pid> or /proc/<pid>/fd.
• ENOSPC or EMFILE errors appearing in Misskey application logs during upload handling.

Detection Strategies

• Monitor HTTP access logs for high-volume POST traffic to multipart API endpoints from a single source or small set of sources.
• Correlate upload request volume with disk utilization and file descriptor metrics to identify leak behavior.
• Alert on sudden drops in free inodes on the filesystem backing the temporary upload path.

Monitoring Recommendations

• Track process-level file descriptor usage and set alert thresholds well below the configured ulimit -n ceiling.
• Measure free disk space on the volume containing the Misskey temp directory and alert on rapid depletion.
• Capture application error rates for upload endpoints and investigate sustained increases in failure counts.

How to Mitigate CVE-2026-103937

Immediate Actions Required

• Upgrade Misskey to version 2026.7.0, which contains the official fix for CVE-2026-103937.
• Restart the Misskey service after upgrade to release any leaked file descriptors from prior process state.
• Clear residual files from the Misskey temporary upload directory to recover disk space before resuming production traffic.

Patch Information

Misskey version 2026.7.0 resolves the vulnerability by wrapping temporary file handling in exception-safe control flow. Review the GitHub Release 2026.7.0 and the GitHub Security Advisory GHSA-m9xp-2fvm-pfmq for upgrade guidance and the full technical description.

Workarounds

• Place rate limiting in front of the Misskey multipart upload endpoints using a reverse proxy such as nginx or a WAF.
• Restrict upload access to authenticated users where configuration allows, reducing the pool of potential attackers.
• Schedule a cron task to periodically remove stale files from the Misskey temporary directory until the patch is applied.

# Example nginx rate limit for Misskey upload endpoints
http {
    limit_req_zone $binary_remote_addr zone=misskey_upload:10m rate=5r/s;

    server {
        location /api/drive/files/create {
            limit_req zone=misskey_upload burst=10 nodelay;
            client_max_body_size 32m;
            proxy_pass http://misskey_backend;
        }
    }
}

# Temporary cleanup cron (adjust path to match your deployment)
# */15 * * * * find /tmp/misskey-* -type f -mmin +30 -delete