CVE-2026-77037High· 7.5▾ TwilightA flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can exploit a file descriptor leak by sending repeated aborted or malformed multipart uploads. This can exhaust system resources, leading …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
0.3% → 0.6%
Last analysed / modified upstream
A flaw was found in multer, a Node.js middleware for handling multipart/form-data. A remote attacker can exploit a file descriptor leak by sending repeated aborted or malformed multipart uploads. This can exhaust system resources, leading to a denial of service (DoS) for the affected application.
multer: Multer: Denial of Service via file descriptor leak on aborted uploads — rated Important by Red Hat. Released 2026-08-28, updated 2026-10-21.
Affected:
Fixed:
No fix planned:
Not affected:
For more about Ansible plugins for Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:86675 For more about Ansible Portal Installer Bootc, see References links https://access.redhat.com/errata/RHSA-2026:82151 For more about Red Hat Developer Hub, see References links https://access.redhat.com/errata/RHSA-2026:76788
Workarounds / mitigations:
Affected packages:
multer = 2.2.0Patched in:
multer 2.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77063Low· 3.7multer: Multer: File size limit bypass via asynchronous file filter race condition (CVE-2026-77063)
CVE-2025-40171Medium· 5.5kernel: Kernel: Denial of Service in nvmet-fc due to resource leak (CVE-2025-40171)
CVE-2025-39776Medium· 5.5kernel: mm/debug_vm_pgtable: clear page table entries at destroy_args() (CVE-2025-39776)
CVE-2023-54220High· 7.8In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fix oops for port->pm on uart_change_pm() Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual …
CVE-2022-50750High· 7.8In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak.
CVE-2026-74699Medium· 5.5In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in exec_queue_set_hang_replay_state() The q->replay_state is blindly overwritten, which can potentially leak memory that was previously allocat…