8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-2359

CVE-2026-2359: Multer vulnerable to Denial of Service via resource exhaustion

Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-2359

CVE-2026-2359:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
multer	npm	< 2.1.0	2.1.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is rooted in the multer middleware's management of file uploads, specifically in how it handles premature client disconnections. The provided commit patch clearly illustrates that the makeMiddleware function, which is responsible for returning the multerMiddleware function, has been updated to address this issue. The patch introduces event listeners for aborted and close events on the incoming request stream. In the vulnerable version, these events were not handled, which caused the underlying busboy parser to hang and continue consuming resources, ultimately leading to a Denial of Service. The multerMiddleware function, located in lib/make-middleware.js, is where the busboy instance is set up, making it the precise location of both the vulnerability and its subsequent fix. The inclusion of a new test case in test/error-handling.js further validates this by simulating a client aborting a connection during an upload.

Vulnerable functions

multerMiddleware

lib/make-middleware.js

The `multerMiddleware` function was vulnerable to a Denial of Service attack because it did not properly handle scenarios where a client abruptly disconnects during a file upload. This oversight would leave the underlying `busboy` parser in a running state, continuing to consume resources and leading to their eventual exhaustion. The patch addresses this by introducing 'aborted' and 'close' event handlers on the request object. These handlers ensure that system resources are properly released when a client disconnects, thereby mitigating the vulnerability

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.