Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| multer | npm | >= 2.0.0-alpha.1, < 2.2.0 | 2.2.0 |
| multer | npm | >= 3.0.0-alpha.1, < 3.0.0-alpha.2 | 3.0.0-alpha.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-5038, is a Denial of Service in Multer's diskStorage engine. It occurs when a multipart upload is aborted or malformed, causing partially uploaded files to be left on the server's disk. Over time, these orphaned files can accumulate and exhaust disk space.
The analysis of the patch reveals two key functions contributing to this vulnerability:
makeMiddleware in lib/make-middleware.js: This function, which creates the core request-handling middleware, lacked the logic to track files that were being written but had not yet completed. When a request was aborted, it only cleaned up files that had finished uploading (uploadedFiles), ignoring any in-progress writes. The fix was to introduce a pendingFiles array to keep track of these files and ensure they are included in the cleanup process.
DiskStorage.prototype._handleFile in storage/disk.js: This method is responsible for the actual file I/O. It had two flaws. First, it didn't check if the incoming file stream was already destroyed before creating a destination file, leading to the creation of empty or partial files from aborted requests. Second, it only set the file.path property after the write was complete. This meant that if the process was interrupted, the higher-level cleanup logic in makeMiddleware wouldn't know the location of the file to delete it.
Exploitation would involve an attacker repeatedly initiating file uploads and then aborting them, causing the server to accumulate orphaned files. The identified functions, makeMiddleware (and the middleware it returns) and DiskStorage.prototype._handleFile, would be present in any runtime profile or stack trace generated during such an attack.
makeMiddlewarelib/make-middleware.js
DiskStorage.prototype._handleFilestorage/disk.js