---
title: "GHSA-3p4h-7m6x-2hcm: Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads"
description: "Moderate severity. Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads. Affects multer; fixed in 2.2.0."
url: https://inlinr.com/advisories/GHSA-3p4h-7m6x-2hcm
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

Moderate Vulnerability GHSA-3p4h-7m6x-2hcm CVE-2026-5038 Published 17 Jun 2026

# Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.1.1 Fixed in 2.2.0

On 2.x, the newest line:

```
npm install multer@2.2.0
```

Every release on a timeline

1. Not affected

0.0.1 – 1.4.4  
32 releases
2. Affected

2.0.0 – 2.1.1  
5 releases
3. Fixed

2.2.0 – 2.5.0  
4 releases, latest

41 stable releases of multer, oldest to newest.

## What happens

Impact

A vulnerability in Multer allows an attacker to trigger a Denial of Service (DoS) by aborting or sending malformed multipart uploads, causing orphaned partial files to accumulate on disk when using diskStorage.

Patches

Users should upgrade to `2.2.0`, `3.0.0-alpha.2` or higher

Workarounds

None

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm "https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-5038 "https://nvd.nist.gov/vuln/detail/CVE-2026-5038")  
nvd.nist.gov/vuln/detail/CVE-2026-5038
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer