CVE-2026-5038

MEDIUM

CVSS v3.1: 5.3 · EPSS: 0.0025 (15.7 percentile)

NetworkNo privilegesNo user interactionVendor advisory ref

Source data as of:

At a glance

Severity
MEDIUM
CVSS
5.3 v3.1 · NVD
EPSS
0.0025 (15.7 percentile) · FIRST.org
CISA KEV
No
Attack conditions (CVSS vector)
NetworkNo privilegesNo user interaction · Source: NVD Vector
Affected vendors
expressjs
Published
2026-06-15 · Modified: 2026-06-16

CVSS / EPSS / KEV

CVSS v3.1 5.3 / 10 MEDIUM Source: NVD
EPSS 0.0025 15.7 percentile Source: FIRST.org
CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.

Record details

CVE ID
CVE-2026-5038
CVSS (v3.1)
5.3 (MEDIUM)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Exploitability subscore
3.9
Impact subscore
1.4
EPSS
0.0025 (15.7 percentile) — 2026-06-17
CISA KEV
No
Weakness (CWE)
CWE-459
Affected vendors
expressjs
Affected configurations (CPE)
2
Published
2026-06-15
Modified
2026-06-16
Status
Analyzed

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.