GHSA-qfvm-cv95-jqjf

Suggest an improvement
Source
https://github.com/advisories/GHSA-qfvm-cv95-jqjf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qfvm-cv95-jqjf/GHSA-qfvm-cv95-jqjf.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qfvm-cv95-jqjf
Aliases
Downstream
Published
2026-09-08T21:29:51Z
Modified
2026-09-08T21:45:04Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Details

Impact

A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.

Patches

Users should upgrade to 2.3.0.

Workarounds

None.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-459"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-08T21:29:51Z",
    "nvd_published_at": "2026-08-28T22:16:53Z",
    "severity": "HIGH"
}
References

Affected packages

npm / multer

Package

Name
multer
View open source insights on deps.dev
Purl
pkg:npm/multer

Affected ranges

Type
SEMVER
Events
Introduced
2.2.0
Fixed
2.3.0

Affected versions

2.*
2.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qfvm-cv95-jqjf/GHSA-qfvm-cv95-jqjf.json"