CVE-2026-5038 is a Denial of Service vulnerability affecting multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1. The vulnerability occurs when using diskStorage, where aborted or malformed multipart uploads leave orphaned partial files on disk. This happens because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exploit thi [truncated]
CVE-2026-5079 is a HIGH severity vulnerability in multer, a popular Node.js middleware for handling multipart/form-data. The vulnerability allows an attacker to cause a Denial of Service (DoS) by sending a single HTTP request with a crafted multipart body containing deeply nested field names. This causes the append-field dependency to allocate deeply nested object structures, consuming excessive CPU and memory.
