CVE-2026-2359: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2359 is a Denial of Service (DoS) vulnerability in Multer, a Node.js middleware for handling multipart/form-data, caused by improper resource cleanup when a client drops a connection during a file upload. All versions of Multer prior to 2.1.0 are affected. The vulnerability was published on February 27, 2026, with the patch released the same day. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Multer Advisory).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime): when a client abruptly drops a connection mid-upload, Multer's middleware failed to properly clean up the associated Busboy parser and related stream resources, leaving them allocated indefinitely. The fix (commit cccf0fe) restructures the middleware to register error, aborted, and close event listeners on the request object before initializing Busboy, ensuring that any premature connection termination triggers busboy.destroy() and proper cleanup via abortWithError(). An attacker can exploit this by initiating a multipart file upload with a large declared Content-Length and then immediately dropping the TCP connection, repeating this pattern to exhaust server memory or file descriptors. No authentication or special privileges are required (Multer Commit, GitHub Advisory).

Successful exploitation results in resource exhaustion on the affected Node.js server, degrading or completely denying service to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact, and no data exposure or lateral movement risk is associated with this vulnerability. Applications built on Multer that accept file uploads (e.g., web APIs, IBM API Connect, IBM watsonx Orchestrate, IBM QRadar Suite, and other IBM products shipping Multer as a dependency) are all potentially affected (GitHub Advisory, IBM API Connect).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.042% (0.000420), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low EPSS, the attack requires no authentication, no user interaction, and low complexity, making it trivially automatable against exposed endpoints.

1. Reconnaissance: Identify internet-facing Node.js applications that use Multer for file upload handling (e.g., endpoints accepting multipart/form-data). Tools like Shodan, Censys, or manual inspection of HTTP responses can help identify candidate targets.
2. Craft a partial multipart request: Open a raw TCP connection to the target server and send an HTTP POST request with Content-Type: multipart/form-data; boundary=<boundary> and a large Content-Length (e.g., 999999), followed by the beginning of a multipart body including a file part header and a small amount of data — but do not send the complete body.
3. Drop the connection: After sending the partial data (e.g., after 50ms), abruptly destroy the TCP socket without completing the upload or sending a FIN. This triggers the vulnerability in unpatched Multer versions, leaving Busboy and associated stream resources unreleased.
4. Repeat at scale: Automate steps 2–3 in a loop or with multiple concurrent connections to rapidly exhaust server memory, file descriptors, or event loop capacity, causing service degradation or crash (Multer Commit, GitHub Advisory).

• Network: High volume of incomplete HTTP POST requests to file upload endpoints with Content-Type: multipart/form-data; connections that are established and send partial data then abruptly close without completing the request body.
• Logs: Node.js application logs showing repeated stream or parser errors associated with aborted requests; access logs showing many POST requests to upload endpoints with no corresponding completion or response.
• Process/System: Steadily increasing memory consumption or file descriptor usage in the Node.js process without a corresponding increase in completed requests; eventual out-of-memory errors or process crashes in the application hosting Multer.

Upgrade Multer to version 2.1.0 or later, which includes the fix for improper disconnect handling (commit cccf0fe). No configuration-based workarounds are available for this vulnerability. Organizations using IBM products that bundle Multer (API Connect, watsonx Orchestrate, QRadar Suite, Cloud Pak for Integration, Application Modernization Accelerator, Transformation Advisor, DevOps Solution Workbench, Security QRadar EDR) should apply the relevant IBM security bulletins as they become available (GitHub Advisory, IBM API Connect).

The vulnerability was disclosed by the OpenJS Foundation CNA and credited to researchers nawin23 (finder), UlisesGascon, sheplu, and bjohansebas (remediation reviewers), with ctcpip as the remediation developer (Multer Advisory). IBM issued multiple security bulletins across its product portfolio acknowledging the impact of this CVE on products including API Connect, watsonx Orchestrate, QRadar Suite, and others (IBM API Connect). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking.