---
title: "GHSA-xf7r-hgr6-v32p: Multer vulnerable to Denial of Service via incomplete cleanup"
description: "High severity. Multer vulnerable to Denial of Service via incomplete cleanup. Affects multer; fixed in 2.1.0."
url: https://inlinr.com/advisories/GHSA-xf7r-hgr6-v32p
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

High Vulnerability GHSA-xf7r-hgr6-v32p CVE-2026-3304 Published 1 Mar 2026

# Multer vulnerable to Denial of Service via incomplete cleanup

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.0.2 Fixed in 2.1.0
- 1.x and older 0.0.1 – 1.4.4 No fix, no longer updated

On 2.x, the newest line:

```
npm install multer@2.1.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.0.2  
3 releases
2. Fixed

2.1.0 – 2.5.0  
6 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

0.x 

1. Affected

0.0.1 – 0.1.8  
15 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.

Patches

Users should upgrade to `2.1.0`

Workarounds

None

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:4.0/​AV:N/​AC:L/​AT:N/​PR:N/​UI:N/​VC:N/​VI:N/​VA:H/​SC:N/​SI:N/​SA:N

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p "https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-3304 "https://nvd.nist.gov/vuln/detail/CVE-2026-3304")  
nvd.nist.gov/vuln/detail/CVE-2026-3304
- [Fix commit](https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee "https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee")  
7399190
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://www.cve.org/CVERecord?id=CVE-2026-3304 "https://www.cve.org/CVERecord?id=CVE-2026-3304")  
cve.org/CVERecord