CVE-2026-77037: Express.js Multer DOS Vulnerability

CVE-2026-77037 Overview

CVE-2026-77037 is a resource exhaustion vulnerability [CWE-400] in multer, a Node.js middleware for handling multipart/form-data uploads. Version 2.2.0 fails to close the underlying write file descriptor when a disk-backed upload is aborted or truncated before the write stream finishes. The disk storage engine removes the visible file but leaves a deleted-but-open descriptor behind. A remote attacker can send repeated aborted or malformed multipart uploads to any route using the built-in disk storage, leaking descriptors and retained disk blocks with each request. Sustained abuse exhausts process resources and produces a denial of service until the process is restarted.

Critical Impact
Unauthenticated remote attackers can exhaust file descriptors and disk space on any Express service running multer 2.2.0 with disk storage.

Affected Products

expressjs/multer version 2.2.0
Node.js applications using multer disk storage engine
Express.js services exposing upload routes backed by multer disk storage

Discovery Timeline

2026-08-28 - CVE-2026-77037 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-77037

Vulnerability Analysis

The defect lives in the disk storage engine of multer 2.2.0. When the incoming multipart stream terminates abnormally, the engine unlinks the destination file on disk but does not close the write file descriptor that was opened to receive the upload. The operating system therefore keeps the inode and its allocated blocks alive because a process still holds an open handle. Each aborted upload leaks one descriptor and retains the disk blocks that were written before the abort. Because upload routes are commonly exposed to unauthenticated clients, an attacker can trigger this condition at will.

Root Cause

The cleanup path in the disk storage engine assumes the source stream terminates cleanly. On abnormal termination, the destination write stream is never closed before the file is removed. The remove-then-close ordering, combined with a missing close on the write stream, produces the descriptor leak. The fix in multer 2.3.0 closes the destination write stream on abnormal source termination and defers cleanup until the stream has fully closed.

Attack Vector

The attack requires only network access to any HTTP endpoint that accepts uploads through multer disk storage. An attacker sends a multipart request, then aborts the TCP connection or truncates the body mid-transfer. Repeating this pattern in parallel or in a loop drives the Node.js process toward its ulimit -n descriptor cap and consumes disk blocks held by orphaned inodes. Once the descriptor limit is reached, the service can no longer accept new sockets, open files, or perform normal I/O, resulting in a denial of service that persists until the process is restarted.

Detection Methods for CVE-2026-77037

Indicators of Compromise

Steady growth in open file descriptors for the Node.js process, visible through lsof -p <pid> entries marked (deleted).
Rising disk usage that does not correspond to files visible under the multer upload directory.
HTTP access logs showing repeated POST requests to upload endpoints with client-terminated or truncated connections.
EMFILE or ENFILE errors in application logs after sustained upload traffic.

Detection Strategies

Inventory Node.js services for the expressjs/multer dependency at version 2.2.0 using software composition analysis tools.
Monitor per-process descriptor counts against baseline and alert when growth is unbounded during upload workloads.
Correlate spikes in aborted multipart requests with descriptor and disk metrics on the same host.

Monitoring Recommendations

Track /proc/<pid>/fd counts and open-but-unlinked inodes on hosts running multer upload workers.
Alert on repeated client disconnects during multipart/form-data transfers from the same source address.
Log and rate-limit upload endpoints so anomalous request volumes surface in SIEM dashboards.

How to Mitigate CVE-2026-77037

Immediate Actions Required

Upgrade multer to version 2.3.0 or later in every affected package.json and rebuild deployments.
Restart Node.js processes after upgrade to release descriptors already leaked by earlier abuse.
Apply request size limits and connection timeouts at the reverse proxy in front of upload services.
Rate-limit upload endpoints and require authentication where feasible.

Patch Information

The issue is fixed in multer 2.3.0. The patch closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Refer to the GitHub Security Advisory GHSA-qfvm-cv95-jqjf and the OpenJS Foundation Security Advisories for vendor guidance.

Workarounds

Replace disk storage with multer.memoryStorage() for small uploads where memory usage is acceptable.
Terminate multipart uploads at a hardened reverse proxy that enforces body size and time limits before requests reach multer.
Raise ulimit -n and monitor descriptor use as a stopgap, understanding that this only delays exhaustion rather than preventing it.

bash

# Configuration example
npm install multer@^2.3.0
npm ls multer