CVE-2026-77037

multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.

• CWE-400
• CWE-459

• https://cna.openjsf.org/security-advisories.htmlVendor Advisory
• https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjfVendor Advisory

Published

Aug 28, 2026

Last Modified

Sep 2, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-77029Joomla Extension - yootheme.com - Missing CSRF tokens on fro…4.6
• CVE-2026-7703A flaw has been found in AV Stumpfl Pixera Two Media Server …7.3
• CVE-2026-77031A vulnerability has been found in Tenda CH22 1.0.0.1. The af…7.4
• CVE-2026-77034Joomla Extension - joomlaeventmanager.net - Unauthenticated …6.9
• CVE-2026-77035Joomla Extension - joomlaeventmanager.net - Cross-user event…5.1
• CVE-2026-77036A vulnerability was found in elunez eladmin up to 2.7. The i…6.3
• CVE-2026-7704A vulnerability has been found in AV Stumpfl Pixera Two Medi…4.3
• CVE-2026-7705A flaw has been found in JD Cloud JDCOS 4.5.1.r4518. This vu…6.3
• CVE-2026-77050An issue was discovered in Django 6.1 before 6.1.2, 6.0 befo…5.3
• CVE-2026-77051Improper Neutralization of Special Elements used in an SQL C…9.8
• CVE-2026-77052boneIO Black exposes a Node-RED instance without authenticat…8.7
• CVE-2026-77053boneIO Black firmware ships with authentication disabled by …8.7