Description
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| expressjs | multer | 0.0.0 – < 2.1.0 | 2.1.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
Mkway/CVE-2026-3304 ★ 0 · Mar 6, 2026
Reproduction lab for CVE-2026-3304 — async fileFilter race condition in Multer causes disk exhaustion via orphaned temp files
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | multer | < 2.1.0 | 2.1.0 | GHSA-xf7r-hgr6-v32p |
Advisories 2
- WID-SEC-2026-2394 HCL BigFix (Service Management): Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jul 16, 2026
- WID-SEC-2026-0903 IBM App Connect Enterprise: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Apr 7, 2026