CVE-2026-77037

multer 2.2.0 leaks a file descriptor each time a multipart upload using diskStorage is aborted or truncated before completion, because the destination write stream is never closed. An unauthenticated network client can trigger this simply by repeatedly starting uploads and interrupting them. Each failed request leaves an open file descriptor and retains its disk blocks until the process exits, so sustained repeated failures can exhaust the process's file descriptor limit and cause a full denial of service (availability impact only). Any Node.js application running multer 2.2.0 with disk storage enabled is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no confirmed exploitation is known; a fixed release (2.3.0) is available and no workarounds are provided.

What to do: Upgrade multer to 2.3.0 or later, which closes the write stream on aborted uploads. Inventory your dependency tree (e.g., npm ls multer and lockfiles) to find applications pinned to or resolving to 2.2.0, and prioritize any that use diskStorage on internet-reachable upload endpoints. Since no workarounds exist, as an interim measure monitor file descriptor counts and recycle Node processes that handle high upload-failure volumes until the patch is deployed.