Vulnerabilities

multer 2.2.0 leaks a file descriptor each time a multipart upload using diskStorage is aborted or truncated before completion, because the destination write stream is never closed. An unauthenticated network client can trigger this simply by repeatedly starting uploads and interrupting them. Each failed request leaves an open file descriptor and retains its disk blocks until the process exits, so sustained repeated failures can exhaust the process's file descriptor limit and cause a full denial of service (availability impact only). Any Node.js application running multer 2.2.0 with disk storage enabled is affected. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at 0.3%, so no confirmed exploitation is known; a fixed release (2.3.0) is available and no workarounds are provided.

Do: Upgrade multer to 2.3.0 or later, which closes the write stream on aborted uploads. Inventory your dependency tree (e.g., npm ls multer and lockfiles) to find applications pinned to or resolving to 2.2.0, and prioritize any that use diskStorage on internet-reachable upload endpoints. Since no workarounds exist, as an interim measure monitor file descriptor counts and recycle Node processes that handle high upload-failure volumes until the patch is deployed.

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available.

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

basic-auth-connect is Connect's Basic Auth middleware in its own module. basic-auth-connect < 1.1.0 uses a timing-unsafe equality comparison that can leak timing information. This issue has been fixed in basic-auth-connect 1.1.0.

method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed via the X-HTTP-Method-Override header.