CVE-2026-3304: 
JavaScript vulnerability analysis and mitigation

CVE-2026-3304 is a Denial of Service (DoS) vulnerability in Multer, a Node.js middleware for handling multipart/form-data, caused by incomplete cleanup of temporary resources when processing malformed requests. It affects all Multer versions prior to 2.1.0 and was disclosed on February 27, 2026, with a patch released in version 2.1.0. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, Feedly). Multiple IBM products that bundle Multer are also affected, including IBM API Connect, IBM Cloud Pak for Integration, IBM watsonx Orchestrate, IBM QRadar Suite Software, and others (Feedly).

The root cause is classified as CWE-459 (Incomplete Cleanup): when Multer processes a malformed multipart request — specifically one containing a file part with a missing field name — and an asynchronous fileFilter callback is in use, the middleware fails to remove already-written temporary files if an error occurs during processing of a subsequent part. The fix, applied in commit 739919097, adds a check in lib/make-middleware.js so that if an error has already occurred (errorOccured flag is set), any pending file stream is resumed and its placeholder removed before further processing, preventing orphaned files from accumulating on disk (Multer Commit, GitHub Advisory). No authentication or user interaction is required to trigger the vulnerability; the attacker only needs network access to an endpoint that accepts multipart file uploads.

Successful exploitation causes resource exhaustion on the affected Node.js server: orphaned temporary files accumulate on disk with each malformed request, eventually consuming available disk space and potentially rendering the application unresponsive. The impact is limited to availability — there is no confidentiality or integrity impact, and no lateral movement or data exfiltration risk is associated with this vulnerability. Any application using Multer versions prior to 2.1.0 that exposes a file upload endpoint is at risk, including enterprise products from IBM that embed the vulnerable library (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term probability of exploitation (GitHub Advisory). No threat actor attribution has been reported.

1. Reconnaissance: Identify a target Node.js application that uses Multer versions prior to 2.1.0 and exposes a file upload endpoint (e.g., /upload). Confirm the endpoint accepts multipart/form-data requests.
2. Craft malformed multipart request: Construct a multipart body containing at least two file parts — the first with a valid name attribute and the second with a missing name attribute in the Content-Disposition header (e.g., Content-Disposition: form-data; filename="b.bin" without name="..."). This triggers Multer's error path mid-processing.
3. Trigger async fileFilter race: Ensure the target application uses an asynchronous fileFilter function, which introduces a timing window where the first file is partially written to disk before the error from the second part is processed.
4. Send repeated requests: Repeatedly send the malformed multipart request to the upload endpoint. Each request causes one or more temporary files to be written to the server's temp directory and never cleaned up (orphaned files).
5. Exhaust disk resources: Over time, the accumulation of orphaned temporary files fills the server's disk, causing the Node.js application to become unresponsive or crash due to resource exhaustion (Multer Commit, GitHub Advisory).

• File System: Rapid accumulation of temporary files in the Multer upload destination directory (e.g., /tmp/multer-* or the configured dest path) that are not associated with completed uploads; files persist after requests complete.
• Logs: High volume of HTTP 400 responses from the upload endpoint in application access logs, potentially accompanied by Multer error codes (e.g., LIMIT_UNEXPECTED_FILE or missing field name errors) in Node.js application logs.
• System Metrics: Unusual disk space consumption on the server hosting the Node.js application, particularly in the temporary file directory; disk usage growing steadily without corresponding legitimate upload activity.
• Network: Repeated POST requests to file upload endpoints with Content-Type: multipart/form-data from the same or rotating source IPs, especially with malformed or minimal body content.

The only effective remediation is to upgrade Multer to version 2.1.0 or later, which includes the fix for orphaned file cleanup (GitHub Advisory). No configuration-based workarounds are available. IBM has released security bulletins for affected products (API Connect, Cloud Pak for Integration, watsonx Orchestrate, QRadar Suite, Transformation Advisor, DevOps Solution Workbench, and others) and recommends applying the respective product updates (IBM API Connect, IBM Cloud Pak). As an interim measure, organizations should monitor disk usage on servers running vulnerable Multer versions and consider rate-limiting or WAF rules on file upload endpoints.

The vulnerability was reported by security researcher EthanKim88 and analyzed by ctcpip, with remediation review by UlisesGascon and bjohansebas from the Multer maintainer community (GitHub Advisory). IBM issued multiple security bulletins across its product portfolio acknowledging the impact of CVE-2026-3304 on products embedding Multer (IBM API Connect). A brief write-up was published on dev.to covering the denial-of-service mechanism via incomplete file cleanup in the Multer middleware.