CVE-2026-5038: Expressjs Multer DOS Vulnerability

CVE-2026-5038 Overview

CVE-2026-5038 is a denial of service vulnerability in multer, the popular Node.js middleware for handling multipart/form-data uploads in Express applications. The flaw affects multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. Attackers can exhaust disk space by triggering many aborted uploads, with no application bug required. The issue is tracked as [CWE-459: Incomplete Cleanup].

Critical Impact
Unauthenticated remote attackers can exhaust server disk space by repeatedly aborting multipart uploads, causing application-wide denial of service.

Affected Products

expressjs/multer versions 2.0.0-alpha.1 through 2.1.1
expressjs/multer version 3.0.0-alpha.1
Node.js applications using multer with diskStorage configuration

Discovery Timeline

2026-06-15 - CVE-2026-5038 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-5038

Vulnerability Analysis

The vulnerability resides in how multer handles file streams when an upload is aborted mid-transfer. When a client uploads a file using diskStorage, multer opens an fs.WriteStream and pipes the incoming multipart body into it using Readable.pipe(). If the request aborts before completion, multer does not propagate the destroy signal to the downstream fs.WriteStream. The partial file remains on disk indefinitely. Repeated aborted uploads accumulate orphaned partial files until the file system fills up, halting the application and any other service sharing the volume.

Root Cause

The root cause is incomplete cleanup of resources on the abort path. The internal write stream created for each upload is not tracked by the request lifecycle, so cancellation of the inbound request never reaches it. Readable.pipe() in Node.js does not forward destruction to the writable side by default, and multer did not implement the missing teardown logic. Cleanup only ran on successful completion.

Attack Vector

Exploitation requires no authentication and no application logic flaw. An attacker sends repeated multipart/form-data POST requests to any endpoint that uses multer with diskStorage, and terminates each TCP connection mid-body. Each aborted request leaves a partial file in the configured upload directory. With enough parallel connections, the disk fills within minutes on a typical deployment. The attack is network-reachable, requires low complexity, and yields high availability impact while leaving confidentiality and integrity untouched.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-3p4h-7m6x-2hcm. No public proof-of-concept exploit is available.

Detection Methods for CVE-2026-5038

Indicators of Compromise

Rapid growth of files in the multer upload destination directory with random temporary names
High volume of aborted or prematurely closed multipart/form-data POST requests in web server access logs
Disk usage alerts on volumes hosting application upload directories
Files in the upload directory whose size does not match the declared Content-Length header

Detection Strategies

Inventory Node.js applications and identify those depending on multer versions between 2.0.0-alpha.1 and 2.1.1, or 3.0.0-alpha.1, using Software Composition Analysis (SCA) tooling
Monitor request logs for elevated rates of HTTP 499, 408, or connection-reset responses on upload endpoints
Correlate abrupt disk consumption increases with spikes in multipart/form-data traffic to the same host

Monitoring Recommendations

Configure alerts on file system utilization thresholds for volumes used by multer upload directories
Track the count and age of files in the upload temp directory, alerting on unbounded growth
Enable web application firewall (WAF) telemetry for connection-aborted upload requests from single source IPs

How to Mitigate CVE-2026-5038

Immediate Actions Required

Upgrade multer to version 2.2.0 for the 2.x line, or 3.0.0-alpha.2 for the 3.x prerelease line
Audit all production Node.js services for vulnerable multer versions and prioritize internet-exposed upload endpoints
Implement a scheduled cleanup job to remove stale files older than a defined threshold from multer upload directories
Place upload endpoints behind a rate-limiting reverse proxy or WAF to throttle abusive clients

Patch Information

The maintainers released multer 2.2.0 and multer 3.0.0-alpha.2. Both versions track in-flight write streams and clean them up on the abort path, eliminating orphaned partial files. Refer to the OpenJS Foundation Security Advisories and GitHub Security Advisory GHSA-3p4h-7m6x-2hcm for full patch details.

Workarounds

No official workarounds exist. The vendor explicitly states no mitigation is available short of patching.
As a defense-in-depth measure, isolate the upload directory on a dedicated volume so disk exhaustion does not affect the root file system or other services.
Enforce per-IP request rate limits and concurrent connection caps at the reverse proxy layer to reduce attack throughput.

bash

# Upgrade multer to the patched release
npm install multer@2.2.0 --save

# Or for the 3.x prerelease line
npm install multer@3.0.0-alpha.2 --save

# Verify installed version
npm ls multer