---
title: "GHSA-v52c-386h-88mc: Multer vulnerable to Denial of Service via resource exhaustion"
description: "High severity. Multer vulnerable to Denial of Service via resource exhaustion. Affects multer; fixed in 2.1.0."
url: https://inlinr.com/advisories/GHSA-v52c-386h-88mc
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-v52c-386h-88mc CVE-2026-2359 Published 1 Mar 2026

# Multer vulnerable to Denial of Service via resource exhaustion

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.0.2 Fixed in 2.1.0
- 1.x and older 0.0.1 – 1.4.4 No fix, no longer updated

On 2.x, the newest line:

```
npm install multer@2.1.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.0.2  
3 releases
2. Fixed

2.1.0 – 2.5.0  
6 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

0.x 

1. Affected

0.0.1 – 0.1.8  
15 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion.

Patches

Users should upgrade to `2.1.0`

Workarounds

None

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:4.0/​AV:N/​AC:L/​AT:N/​PR:N/​UI:N/​VC:N/​VI:N/​VA:H/​SC:N/​SI:N/​SA:N

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc "https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-2359 "https://nvd.nist.gov/vuln/detail/CVE-2026-2359")  
nvd.nist.gov/vuln/detail/CVE-2026-2359
- [Fix commit](https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab "https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab")  
cccf0fe
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://www.cve.org/CVERecord?id=CVE-2026-2359 "https://www.cve.org/CVERecord?id=CVE-2026-2359")  
cve.org/CVERecord