{"id":"CVE-2026-88932","revision":"94129ddea8e94b2fa1fa0941e34fadb2","records":[{"revision":"94129ddea8e94b2fa1fa0941e34fadb2","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-88932","aliases":[],"title":"multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are …","description":"multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.","state":0,"publishedAt":"2026-09-14T09:17:01.63+00:00","modifiedAt":"2026-09-16T19:40:00.317+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88932","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-400","CWE-459"],"productCriteria":[],"sourceDates":{"published":"2026-09-14T09:17:01.630","lastModified":"2026-09-16T19:40:00.317"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-88932","identifiers":["CVE-2026-88932"]},"retained":false,"historicalAffected":[]}],"coverage":[]}