Npm · Multer · CVE-2026-5038
**Name of the Vulnerable Software and Affected Versions**
multer versions 2.0.0-alpha.1 through 2.1.1
multer version 3.0.0-alpha.1
**Description**
A Denial of Service issue exists when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the `Readable.pipe()` call does not propagate the stream destroy signal to the underlying `fs.WriteStream`. This allows an attacker to exhaust disk space by triggering numerous aborted uploads.
**Recommendations**
Upgrade to version 2.2.0 for versions 2.0.0-alpha.1 through 2.1.1.
Upgrade to version 3.0.0-alpha.2 for version 3.0.0-alpha.1.