CVE-2026-88932

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0 , when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, leaving orphaned files on disk. A remote un...

CVE-2026-88932 multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

EUVD-2026-77332

multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned...

DEBIAN-CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

UBUNTU-CVE-2026-87776

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87776 compression vulnerable to Denial of Service via memory leak on premature response close

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

CVE-2026-87859

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote attacker can exploit this vulnerability by injecting an unescaped double quote into a log field they control, such as the User-Agent or Referer header. This causes the log field to close...

DEBIAN-CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

CVE-2026-87859

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1 , the escapeLogField() function fails to escape the double quote character, which delimits quoted fields in the Apache combined log format. An unauthenticated remote attacker who controls a value written to a quote...

CVE-2026-87859 morgan vulnerable to Log Injection via unescaped double quote in quoted log fields

morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, which delimits the quoted fields of the Apache combined log format that morgan emits. An unauthenticated remote attacker who controls a value...

Linux Distros Unpatched Vulnerability : CVE-2026-87859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField function does not escape the double quote character, whic...

PT-2026-89865

compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zl...

EUVD-2026-67928

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads...

EUVD-2026-67929

multer vulnerable to file size limit bypass via async fileFilter race condition...

EUVD-2026-67720

morgan vulnerable to Log Forging via unescaped Unicode line separators...

CVE-2026-15603

A flaw was found in morgan, an HTTP request logger middleware for Node.js. An unauthenticated remote client can inject specific Unicode line separator characters into log token values. This manipulation can cause downstream log processing systems to misinterpret a single log entry as multiple...

Linux Distros Unpatched Vulnerability : CVE-2026-15603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the...