7.5

CVE-2026-5038: expressjs multer Incomplete Cleanup

CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-3p4h-7m6x-2hcm
Published 15-06-2026Last modified 15-06-2026
Open JSON

Vulnerability summary

CVE-2026-5038 is a high (CVSS 7.5) Incomplete Cleanup vulnerability in expressjs multer. EPSS estimates a 0.49% chance of exploitation in the next 30 days, higher than 40.7% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (NVD)
EPSS score
0.49%
0%100%
Low · +0.21 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 15-06-2026
    PublishedVulnerability first disclosed.
  2. 15-06-2026
    Last modifiedVulnerability information updated.

Description

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.49%

Chance of exploitation in the next 30 days

Percentile

41%

Versus all other CVEs

30-day change

+0.21 pp

From 0.28% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.49%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Expressjs1 product
  • multer≥ 2.0.0, < 2.2.0 | 3.0.0:alpha1
Multer1 product
  • multer≥ 2.0.0-alpha.1, < 2.2.0 | ≥ 3.0.0-alpha.1, < 3.0.0-alpha.2
Npm1 product
  • multer≥ 2.0.0-alpha.1, < 2.2.0 | ≥ 3.0.0-alpha.1, < 3.0.0-alpha.2

3 vendors · 3 products

References

4 links