These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-113872 multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown. This vulnerability affects applications using multer with asynchronous fileFilter, potentially leading to Denial of Service attacks. Upgrading to multer 2.5.0 or later is recommended. The vulnerability is triggered when a request is aborted while another file's async fileFilter is still pen [truncated]
CVE-2026-5038 is a Denial of Service vulnerability affecting multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1. The vulnerability occurs when using diskStorage, where aborted or malformed multipart uploads leave orphaned partial files on disk. This happens because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exploit thi [truncated]
CVE-2026-5079 is a HIGH severity vulnerability in multer, a popular Node.js middleware for handling multipart/form-data. The vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a single HTTP request with a crafted multipart body containing deeply nested field names. This causes the append-field dependency to allocate deeply nested object structures, consuming excessive CPU and memory.