CVE-2026-88932 Overview
CVE-2026-88932 affects multer, a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, aborted upload requests using disk storage can leave orphaned files behind. When a client aborts an upload after multer's cleanup routine executes, in-flight file writes complete without being removed. A remote unauthenticated attacker can repeatedly initiate and abort uploads to accumulate orphaned files. This behavior exhausts disk space and causes a denial of service on the host. The issue is fixed in multer 2.4.0.
Critical Impact
Remote unauthenticated attackers can exhaust disk space on servers running vulnerable multer versions by abusing aborted multipart uploads.
Affected Products
- multer 2.2.0 through 2.3.0 (Node.js middleware)
- Node.js applications using multer with disk storage configuration
- Express.js applications relying on affected multer releases
Discovery Timeline
- 2026-09-14 - CVE-2026-88932 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-88932
Vulnerability Analysis
The flaw is classified under [CWE-400] Uncontrolled Resource Consumption. multer handles multipart uploads by streaming incoming file data to disk when configured with disk storage. When a request is aborted mid-upload, multer runs a cleanup routine that removes partial files written up to that point. The race condition arises because file writes that complete after cleanup executes are not tracked or deleted. Each aborted request can therefore leave one orphaned file on the target filesystem. An attacker exploits this by opening upload connections, sending partial file data, and terminating the request. Repeating this at scale accumulates files that consume disk capacity.
Root Cause
The cleanup handler in multer disk storage does not synchronize with pending write operations. The abort handler enumerates known partial files and unlinks them, but write callbacks completing after this enumeration produce files outside the cleanup scope. There is no post-abort reconciliation to remove late-arriving writes.
Attack Vector
Exploitation requires only network access to any HTTP endpoint that accepts multipart uploads through the vulnerable middleware. No authentication or user interaction is required. The attacker sends multipart/form-data requests with file parts and terminates the TCP connection before completion. Repeated abuse fills the upload destination directory until the filesystem or quota is exhausted, causing service degradation or outage.
Refer to the GitHub Security Advisory GHSA-3pph-fpjx-jg34 for maintainer-provided technical details.
Detection Methods for CVE-2026-88932
Indicators of Compromise
- Rapid growth of the multer upload destination directory without corresponding successful upload records in application logs.
- Large volume of aborted or prematurely closed HTTP requests to endpoints handling multipart/form-data.
- Files in the upload directory with no matching database entries or business workflow references.
Detection Strategies
- Inventory Node.js dependencies with npm ls multer or Software Composition Analysis (SCA) tooling to identify versions 2.2.0 through 2.3.0.
- Monitor filesystem usage on hosts running Node.js upload services and alert on abnormal growth rates.
- Correlate web server access logs for high rates of client-aborted uploads from single or distributed sources.
Monitoring Recommendations
- Configure disk utilization alerts on partitions hosting multer upload directories.
- Track HTTP request completion status and flag spikes in aborted POST requests to upload routes.
- Log the count and size of files created in the upload directory per source IP for anomaly detection.
How to Mitigate CVE-2026-88932
Immediate Actions Required
- Upgrade multer to version 2.4.0 or later in all Node.js projects.
- Audit upload directories for orphaned files and remove entries not tied to legitimate application state.
- Apply rate limiting and connection throttling to upload endpoints exposed to untrusted networks.
Patch Information
The maintainers fixed the issue in multer 2.4.0. Update the dependency using npm install multer@^2.4.0 or the equivalent for yarn or pnpm. Verify no transitive dependencies pin an older release. Consult the OpenJS Foundation Security Advisories for coordinated release information.
Workarounds
- Enforce request size and count limits at a reverse proxy or Web Application Firewall (WAF) in front of upload endpoints.
- Schedule a periodic cleanup job that removes files in the upload directory older than a defined threshold and not referenced by application records.
- Store uploads on a dedicated volume with quotas so orphaned files cannot exhaust space used by other services.
# Configuration example
npm install multer@^2.4.0
npm ls multer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
