CVE-2026-3304: Multer vulnerable to Denial of Service via incomplete cleanup
Impact
A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.
Patches
Users should upgrade to 2.1.0
Workarounds
None
Other sources
Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.1.0 - Upgrade
Upgrade
Multerto a version that resolves this vulnerability.Fixed in 2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3304?
CVE-2026-3304 is a Denial of Service vulnerability with a severity level that can lead to application downtime.
How do I fix CVE-2026-3304?
To fix CVE-2026-3304, upgrade Multer to version 2.1.0 or later.
What software is affected by CVE-2026-3304?
CVE-2026-3304 affects Multer versions prior to 2.1.0, a middleware for handling multipart/form-data in Node.js.
What type of vulnerability is CVE-2026-3304?
CVE-2026-3304 is classified as a Denial of Service (DoS) vulnerability due to incomplete cleanup.
How can CVE-2026-3304 be exploited?
CVE-2026-3304 can be exploited by sending malformed requests that trigger resource exhaustion in the application.