CVE-2026-2359

HighCVSS 7.5/10Last modified Jul 15, 2026

Description

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2026
Last modified: Jul 15, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-235927.2Insecure file operations in HPE Aruba Networking Fabric Composerâ€™s backup functionality could allow authenticated attackers to achieve rem CVE-2026-235937.5A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker CVE-2026-235958.8An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit CVE-2026-235966.5A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Su CVE-2026-235976.5Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to o CVE-2026-235986.5Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to o CVE-2026-235997.8A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful CVE-2026-23608.0PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public s CVE-2026-236009.8A remote authentication bypass vulnerability exists in HPE AutoPass License Server (APLS).CVE-2026-236015.4A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key au CVE-2026-236033.1Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim CVE-2026-236045.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation work