Multer is a middleware used in Node.js applications to handle multipart/form-data uploads. In version 2.2.0, the disk‑storage engine does not close the underlying file descriptor when an upload is aborted or truncated before the write stream finishes. Consequently, the file is removed from the filesystem but the descriptor remains open, keeping disk blocks allocated. An attacker who can access an upload route can repeatedly send aborted or malformed uploads, each leak consuming a file descriptor and keeping disk space until the process terminates. The result is exhaustion of system resources and denial of service to legitimate users.

The vulnerability affects the multer middleware for Node.js, specifically versions 2.2.0 and earlier. Applications that expose file upload endpoints using the default disk‑storage configuration are susceptible. The issue was fixed in multer 2.3.0, which properly closes the destination write stream under abnormal termination and defers cleanup until the stream has closed.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score is not available, but because the flaw requires only the ability to reach an upload endpoint, the likely attack vector is remote HTTP access to an application that uses multer. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet, but the resource exhaustion nature means that even a single successful exploit can affect availability. Monitoring resource usage and limiting the number of open descriptors remain critical until a patch can be applied.