CVE-2026-88932

MediumCVSS 5.3/10Last modified Sep 16, 2026

Description

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400CWE-459

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
multermulter>= 2.2.0, < 2.4.0

References

Timeline

Published
Sep 14, 2026
Last modified
Sep 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-889378.8knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to reCVE-2026-889386.5knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read sCVE-2026-889398.3knowns through 0.33.0 exempts the project.set action from permission guard checks unconditionally, allowing read-only agent sessions to bypaCVE-2026-88946.4The iWR Tooltip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `iwrtooltip` shortcode in versions up to,CVE-2026-889405.3knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arCVE-2026-889415.2Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentiallCVE-2026-889426.1The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter CVE-2026-889444.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and iCVE-2026-88956.4The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions upCVE-2026-889529.1Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuCVE-2026-889566.8The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interfCVE-2026-889598.8Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-priv