CyberRota Analysis
AI-GeneratedThe multer middleware for Node.js versions 2.2.0 to 2.3.0 is vulnerable to a denial-of-service attack due to orphaned files being left on disk when uploads are aborted. This allows a remote unauthenticated attacker to exploit the vulnerability by repeatedly initiating and aborting uploads, potentially exhausting disk space. Users of affected versions should prioritize upgrading to multer 2.4.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.