CVE-2026-3304 Multer vulnerable to Denial of Service via incomplete cleanup

🗓️ 27 Feb 2026 15:44:37Reported by openjsType

CVE-2026-3304: Multer before 2.1.0 is vulnerable to DoS from malformed requests; upgrade to 2.1.0.

Reporter	Title	Published	Views	Family All 34
GithubExploit	Exploit for CVE-2026-3304	6 Mar 202608:37	–	githubexploit
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench	7 May 202612:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in multer-2.0.2.tgz	28 Apr 202619:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to Node.js module Multer (CVE-2026-2359, CVE-2026-3304 & CVE-2026-3520)	27 Mar 202617:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerabilities in multer-2.0.2.tgz	7 May 202619:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	27 Mar 202616:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Application Modernization Accelerator is vulnerable to multiple vulnerabilities found in Node.js	16 Apr 202615:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	2 Jun 202608:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Transformation Advisor is affected by multiple vulnerabilities found in Node.js	16 Apr 202615:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to denial of service due to vulnerabilities in Node.js dependencies	7 Apr 202616:09	–	ibm

[
  {
    "defaultStatus": "unaffected",
    "packageURL": "pkg:npm/multer",
    "product": "multer",
    "vendor": "expressjs",
    "versions": [
      {
        "lessThan": "2.1.0",
        "status": "affected",
        "version": "0.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
github	www.github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p
github	www.github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee
cna	www.cna.openjsf.org/security-advisories.html
cve	www.cve.org/CVERecord

27 Feb 2026 15:44Current

CVSS 48.7

EPSS0.00019

CWE-459