GHSA-xf7r-hgr6-v32p
NoneCVSS
—
EPSS
—
Published
Mar 1, 2026
CISA due date
—
The record
Multer vulnerable to Denial of Service via incomplete cleanup
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | multer | 0 | 2.1.0 |
Related vulnerabilities
- CVE-2026-3304 Multer is a node.js middleware for handling `multipart/form-data`. Same vulnerability
- GHSA-72gw-mp4g-v24j Multer vulnerable to Denial of Service via deeply nested field names Also affects multer
- GHSA-3p4h-7m6x-2hcm Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads Also affects multer
- CVE-2026-5038 Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a… Also affects multer
- CVE-2026-5079 Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial… Also affects multer
- GHSA-5528-5vmv-3xc2 Multer Vulnerable to Denial of Service via Uncontrolled Recursion Also affects multer
- CVE-2026-3520 Multer is a node.js middleware for handling `multipart/form-data`. Also affects multer
- GHSA-v52c-386h-88mc Multer vulnerable to Denial of Service via resource exhaustion Also affects multer