4591-libs (>=0.0.1, <=0.2.0), @10abdullahbutt/nestjs-boilerplate (0.0.1) +1553 more potentially affected by CVE-2026-5038 via multer (>=2.0.0, <=2.1.1)

🗓️ 17 Jun 2026 18:11:48Reported by Vulners OSVType

vulnersosv🔗 osv.dev👁 1 Views

Multer 2.0.0-2.1.1 affected by CVE-2026-5038; 1,555 npm packages transitively impacted.

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	12 Aug 202613:52	–	ibm
IBM Security Bulletins	Security Bulletin: Data Synchronization App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	30 Jul 202614:05	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple Node.js modules	23 Jul 202608:40	–	ibm
Circl	CVE-2026-5038	15 Jun 202614:30	–	circl
CVE	CVE-2026-5038	15 Jun 202614:23	–	cve
Cvelist	CVE-2026-5038 multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads	15 Jun 202614:23	–	cvelist
EUVD	EUVD-2026-36728	17 Jun 202618:11	–	euvd
Github Security Blog	Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads	17 Jun 202618:11	–	github
NVD	CVE-2026-5038	15 Jun 202616:16	–	nvd
OSV	GHSA-3P4H-7M6X-2HCM Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads	17 Jun 202618:11	–	osv

17 Jun 2026 18:15Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.3 - 7.5

EPSS0.00278

SSVC

multer CVE-2026-5038 transitive dependency npm packages file upload