---
id: CVE-2026-88932
title: multer is a Node.js middleware for handling multipart/form-data uploads
summary: >-
  multer is a Node.js middleware for handling multipart/form-data uploads. In
  versions 2.2.0 through 2.3.0, when a request using disk storage is aborted
  mid-upload, file writes that complete after multer has already run its abort
  cleanup a…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
  - CWE-459
vendor: Red Hat
product: Red Hat Developer Hub
affected:
  - 3scale_api_management_platform 2
  - developer_hub
  - self_service_automation_portal 2
published: '2026-09-14'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T19:40:00.317'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88932'
references:
  - url: 'https://cna.openjsf.org/security-advisories.html'
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34
    label: ce714d77-add3-4f53-aff5-83d477b104bb
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88932.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-88932'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532957'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-88932'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88932'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00314
epssPercentile: 0.2455
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-14T10:28:47.353955Z'
ingestedAt: '2026-09-14T15:23:07.463Z'
---

## Overview

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Developer Hub, Self-service automation portal 2 · no fix planned: Red Hat Developer Hub, Self-service automation portal 2 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-88932.json)