CVE-2026-2359: Multer Node.js Middleware DoS Vulnerability

CVE-2026-2359 Overview

CVE-2026-2359 is a Denial of Service (DoS) vulnerability affecting Multer, a popular Node.js middleware used for handling multipart/form-data, commonly utilized for file uploads in Express.js applications. The vulnerability allows an attacker to trigger resource exhaustion by dropping a connection during the file upload process. This improper handling of aborted connections can lead to service degradation or complete unavailability of affected applications.

Critical Impact

Applications using Multer versions prior to 2.1.0 are vulnerable to resource exhaustion attacks that can cause service unavailability through maliciously dropped connections during file uploads.

Affected Products

• Multer versions prior to 2.1.0
• Node.js applications using vulnerable Multer middleware
• Express.js applications with file upload functionality using affected Multer versions

Discovery Timeline

• 2026-02-27 - CVE CVE-2026-2359 published to NVD
• 2026-03-02 - Last updated in NVD database

Technical Details for CVE-2026-2359

Vulnerability Analysis

This vulnerability is classified under CWE-772 (Missing Release of Resource after Effective Lifetime). When a client initiates a file upload and then abruptly drops the connection before completion, Multer fails to properly release allocated resources. The middleware does not adequately handle the cleanup of file handles, memory buffers, and other resources associated with the interrupted upload session.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous for public-facing applications. An attacker can repeatedly initiate uploads and drop connections, gradually exhausting server resources until the application becomes unresponsive or crashes.

Root Cause

The root cause lies in Multer's disconnect handling mechanism. Prior to the fix, the middleware's error handling and resource cleanup logic was inadequate for scenarios where connections are terminated mid-upload. The FileAppender and Busboy parser initialization occurred before proper connection state handling was established, leading to orphaned resources when connections dropped unexpectedly.

Attack Vector

The attack exploits the network-accessible file upload functionality. An attacker can:

1. Initiate a multipart/form-data file upload request to a vulnerable endpoint
2. Begin transmitting data to trigger resource allocation
3. Abruptly terminate the connection before upload completion
4. Repeat this process to accumulate orphaned resources
5. Continue until server resources are exhausted, causing denial of service

 
    req.body = Object.create(null)
 
-    req.on('error', function (err) {
-      abortWithError(err)
-    })
-
     var busboy
-
-    try {
-      busboy = Busboy({
-        headers: req.headers,
-        limits: limits,
-        preservePath: preservePath,
-        defParamCharset: defParamCharset
-      })
-    } catch (err) {
-      return next(err)
-    }
-
-    var appender = new FileAppender(fileStrategy, req)
+    var appender = null
     var isDone = false
     var readFinished = false
     var errorOccured = false

Source: GitHub Commit for Multer Fix

The patch improves disconnect handling by deferring FileAppender initialization and restructuring the error handling flow to ensure proper resource cleanup when connections are dropped.

Detection Methods for CVE-2026-2359

Indicators of Compromise

• Unusual spikes in incomplete file upload requests to application endpoints
• Increasing memory utilization without corresponding legitimate traffic
• Growing number of orphaned temporary files in upload directories
• Application performance degradation correlated with upload endpoint activity

Detection Strategies

• Monitor for patterns of repeated partial upload requests from single IP addresses
• Implement rate limiting detection for multipart/form-data requests
• Track connection abort rates on file upload endpoints
• Analyze server logs for abnormal ratios of started-to-completed uploads

Monitoring Recommendations

• Set up alerts for memory utilization thresholds on servers running Multer
• Monitor file descriptor counts and temporary storage usage
• Implement application performance monitoring (APM) for upload endpoints
• Review Express.js access logs for suspicious upload patterns

How to Mitigate CVE-2026-2359

Immediate Actions Required

• Upgrade Multer to version 2.1.0 or later immediately
• Audit applications for usage of vulnerable Multer versions
• Implement rate limiting on file upload endpoints as a defensive measure
• Consider implementing connection timeouts for upload operations

Patch Information

Users should upgrade to Multer version 2.1.0 to receive the security patch that improves disconnect handling. The fix is available in the GitHub Commit for Multer Fix. Additional information can be found in the GitHub Security Advisory GHSA-v52c-386h-88mc and the OpenJS Foundation Security Advisories.

Workarounds

• No known workarounds are available for this vulnerability
• Upgrading to version 2.1.0 is the only recommended remediation
• Consider temporarily disabling file upload functionality if upgrade is not immediately possible
• Implement network-level rate limiting as a partial mitigation measure

# Upgrade Multer to patched version
npm update multer@2.1.0

# Verify installed version
npm list multer