Multer, a node.js middleware that handles multipart/form-data, contains a flaw that allows an attacker to trigger a denial of service by dropping the connection during a file upload. The vulnerability can cause resource exhaustion, leading to a loss of service availability. It is classified as CWE-772, indicating a problem with resource management in the code.

Expressjs Multer versions earlier than 2.1.0 are affected. Any Node.js application that incorporates Multer before this version for handling file uploads could be impacted.

The CVSS score of 8.7 marks this issue as high severity. The EPSS score of <1% suggests that exploitation is currently unlikely, and it is not listed in the CISA KEV catalog. The likely attack vector involves a client or malicious user sending a file upload request and intentionally dropping the connection mid‑stream, which can be performed without special privileges. Even with a low exploitation probability, the high impact on availability warrants immediate remediation.