CVE-2026-88932
Description
A flaw was found in multer, a Node.js middleware for handling multipart/form-data uploads. When a request using disk storage is aborted during an upload, file writes that complete after multer's cleanup process are not removed. This can leave orphaned files on disk. A remote unauthenticated attacker can repeatedly initiate and abort uploads to accumulate these orphaned files, which can exhaust disk space and lead to a denial of service.
Statement
This Moderate flaw in multer can lead to a denial of service in Red Hat products that process multipart/form-data uploads. A remote unauthenticated attacker can repeatedly initiate and abort uploads, causing orphaned files to accumulate and exhaust available disk space. This risk is present in deployments where multer is configured for disk storage.
Mitigation
Until updates are available, administrators can implement the following mitigations to reduce the risk of disk exhaustion:
1. Monitor disk usage on systems running Red Hat Developer Hub or Ansible Portal and set up alerts for unusual disk consumption patterns.
2. Implement rate limiting on file upload endpoints to restrict the number of upload requests from a single IP address or user account within a given time period.
3. If authentication is not strictly required for file upload endpoints, enable authentication to reduce the attack surface to authenticated users only.
4. Periodically clean up orphaned temporary files in multer's storage directory. The default upload directory is typically in the system temp folder or a configured uploads directory.
5. Set disk quota limits for the user account or partition used by the application to prevent complete disk exhaustion from affecting the entire system.
For production environments, apply updates as they become available from Red Hat product teams.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 5.3 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | Low | N/A | Low |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
