Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of
    Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on
    disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying
    fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application
    bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease).
    Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.
    (CVE-2026-5038)

ID	Name	Product	Family	Type	Severity
462634	Echo: multer: security update to 2.1.1+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	high
462634	Echo: multer: security update to 2.1.1+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
443385	SCA: security update for multer (GHSA-3p4h-7m6x-2hcm)	Tenable Cloud Security	SCA Checks	Local	high
443385	SCA: security update for multer (GHSA-3p4h-7m6x-2hcm)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-5038

high

Tenable Plugins

high

high

high

high