Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-14T08:46:12 multer: multer: Denial of Service via orphaned disk writes on aborted uploads 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-459

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.

A flaw was found in multer, a Node.js middleware for handling multipart/form-data uploads. When a request using disk storage is aborted during an upload, file writes that complete after multer's cleanup process are not removed. This can leave orphaned files on disk. A remote unauthenticated attacker can repeatedly initiate and abort uploads to accumulate these orphaned files, which can exhaust disk space and lead to a denial of service.

This Moderate flaw in `multer` can lead to a denial of service in Red Hat products that process multipart/form-data uploads. A remote unauthenticated attacker can repeatedly initiate and abort uploads, causing orphaned files to accumulate and exhaust available disk space. This risk is present in deployments where `multer` is configured for disk storage. Until updates are available, administrators can implement the following mitigations to reduce the risk of disk exhaustion: 1. Monitor disk usage on systems running Red Hat Developer Hub or Ansible Portal and set up alerts for unusual disk consumption patterns. 2. Implement rate limiting on file upload endpoints to restrict the number of upload requests from a single IP address or user account within a given time period. 3. If authentication is not strictly required for file upload endpoints, enable authentication to reduce the attack surface to authenticated users only. 4. Periodically clean up orphaned temporary files in multer's storage directory. The default upload directory is typically in the system temp folder or a configured uploads directory. 5. Set disk quota limits for the user account or partition used by the application to prevent complete disk exhaustion from affecting the entire system. For production environments, apply updates as they become available from Red Hat product teams. Red Hat 3scale API Management Platform 2 Not affected 3scale-amp2/system-rhel8 Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Affected rhdh/rhdh-hub-rhel9 Self-service automation portal 2 Affected ansible-automation-platform/automation-portal Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-88932 https://nvd.nist.gov/vuln/detail/CVE-2026-88932 https://cna.openjsf.org/security-advisories.html https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34