CVE-2026-2359: Multer vulnerable to Denial of Service via resource exhaustion
Impact
A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion.
Patches
Users should upgrade to 2.1.0
Workarounds
None
Other sources
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2359?
CVE-2026-2359 is classified as a medium severity vulnerability.
How do I fix CVE-2026-2359?
To fix CVE-2026-2359, upgrade Multer to version 2.1.0 or later.
What causes CVE-2026-2359?
CVE-2026-2359 is caused by a Denial of Service vulnerability due to resource exhaustion during file uploads.
Which versions of Multer are affected by CVE-2026-2359?
All versions of Multer prior to 2.1.0 are affected by CVE-2026-2359.
What type of attack is associated with CVE-2026-2359?
CVE-2026-2359 is associated with Denial of Service attacks that exploit file upload interruptions.