Listen to this Post
multer is a widely used Node.js middleware for handling `multipart/form-data` uploads. In version 2.2.0, a critical flaw exists in the `diskStorage` engine’s cleanup routine. When a multipart upload is aborted or truncated before the write stream finishes, the destination write stream is not properly closed. Although the visible file is removed from the filesystem, the underlying write file descriptor remains open. This open descriptor continues to hold its associated disk blocks until the Node.js process exits.
A remote attacker can exploit this by sending repeated aborted or malformed multipart uploads to any route that uses multer’s built-in disk storage. Each failed request leaks one file descriptor and retains its disk space. Over time, sustained attacks can exhaust the system’s available file descriptors, preventing the application from opening new files or handling legitimate requests. The leaked disk blocks also contribute to storage exhaustion. Since the descriptors are only released when the process terminates, a server restart is required to recover from a successful attack.
The vulnerability is rooted in the `_removeFile` error path, which fails to close the write stream on abnormal source termination. The fix in multer 2.3.0 addresses this by closing the destination write stream when the source stream terminates abnormally, and defers cleanup until the stream has fully closed. All applications using multer’s disk storage are affected. No workarounds are available; upgrading to version 2.3.0 is the only remedy.
DailyCVE Form:
Platform: Node.js/multer
Version: 2.2.0
Vulnerability: File Descriptor Leak
Severity: High (CVSS 7.5)
Date: 2026-09-08
Prediction: 2026-09-15
What Undercode Say:
Analytics
- Attack Vector: Remote, unauthenticated
- Prerequisites: Reachable upload route using `diskStorage`
– Minimum Requests to Exhaust FD: Depends on systemulimit -n; typically 1024–65536 - Recovery: Manual process restart required
- Detection: Monitor `lsof | grep deleted` for leaked descriptors
Bash Commands to Detect Leaks:
Check current open file descriptors for the Node.js process lsof -p $(pgrep -f "node.app.js") | wc -l Identify deleted files still held open (leaked descriptors) lsof -p $(pgrep -f "node.app.js") | grep deleted Monitor system-wide file descriptor usage watch -n 1 'lsof | wc -l'
Node.js Code to Reproduce (Educational Purposes):
const express = require('express');
const multer = require('multer');
const app = express();
const storage = multer.diskStorage({
destination: './uploads/',
filename: (req, file, cb) => cb(null, file.originalname)
});
const upload = multer({ storage });
app.post('/upload', upload.single('file'), (req, res) => {
res.send('Uploaded');
});
app.listen(3000);
Exploit (Educational Purposes!):
Abort upload mid-stream to trigger descriptor leak curl -X POST http://localhost:3000/upload \ -H "Content-Type: multipart/form-data" \ -F "file=@/dev/zero" \ --limit-rate 1k \ --max-time 1
Protection:
- Upgrade to multer `2.3.0` immediately
- If upgrade is not possible, restart the Node.js process periodically as a temporary mitigation
- Implement a reverse proxy or API gateway with request timeouts and rate limiting to reduce attack surface
- Monitor file descriptor usage and set up alerts for abnormal growth
Impact:
- Denial of Service: Exhaustion of file descriptors prevents the application from handling new uploads or opening files
- Storage Exhaustion: Leaked disk blocks accumulate, consuming available storage
- Process Instability: Once descriptors are exhausted, the Node.js process may become unresponsive or crash
- No Data Loss: The vulnerability does not expose or corrupt existing data; it only affects availability
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
