Packages / multer / Security

ModerateVulnerabilityGHSA-3p4h-7m6x-2hcmCVE-2026-5038Published 17 Jun 2026

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Your version

Affected releases · multer

  • 2.x2.0.0 – 2.1.1Fixed in 2.2.0

On 2.x, the newest line:

npm install multer@2.2.0
Every release on a timeline

  1. Not affected

    0.0.1 – 1.4.4

    32 releases

  2. Affected

    2.0.0 – 2.1.1

    5 releases

  3. Fixed

    2.2.0 – 2.5.0

    4 releases, latest

41 stable releases of multer, oldest to newest.

What happens

Impact

A vulnerability in Multer allows an attacker to trigger a Denial of Service (DoS) by aborting or sending malformed multipart uploads, causing orphaned partial files to accumulate on disk when using diskStorage.

Patches

Users should upgrade to 2.2.0, 3.0.0-alpha.2 or higher

Workarounds

None