Description
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy signal to the underlying fs.WriteStream. An attacker can exhaust disk space by triggering many aborted uploads, with no application bug required. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease). Both versions track in-flight write streams and clean them up on the abort path. Workarounds: None.
Problem types
Product status
2.0.0-alpha.1 (semver) before 2.2.0
2.2.0 (semver)
3.0.0-alpha.1 (semver) before 3.0.0-alpha.2
3.0.0-alpha.2 (semver)
Credits
yuki-matsuhashi
HamdaanAliQuatil
fasrm
UlisesGascon
bjohansebas
0xStraw-Hat
bhaswanthc
ByamB4
sbouabid-sec
DavidCarliez
JebeenLee
References
github.com/...multer/security/advisories/GHSA-3p4h-7m6x-2hcm
cna.openjsf.org/security-advisories.html