{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-1056B266",
  "slug": "cve-2026-88932-multer-aborted-upload-orphaned-disk-dos",
  "title": "Multer aborted uploads leave orphaned disk files",
  "aliases": [
    "CVE-2026-88932",
    "multer orphaned disk DoS"
  ],
  "summary": "multer 2.2.0–2.3.0 on disk storage can leave orphaned files when a multipart upload is aborted after multer's abort cleanup already ran, so repeated abort storms fill the disk. Upgrade to multer 2.4.0. This is a follow-on class after earlier abort-handling work, not the same bug as the prior 5038-era fix alone.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Only disk-storage configurations are implicated; memory storage is out of scope. Whether your reverse proxy aborts mid-body affects exploitability.",
  "firstObservedAt": "2026-09-14T09:00:26.299Z",
  "lastObservedAt": "2026-09-16T00:00:00.000Z",
  "publishedAt": "2026-09-20T13:02:24.590Z",
  "reviewedAt": "2026-09-20T13:02:09.847Z",
  "expiresAt": "2026-09-16T00:00:00.000Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "ghsa-multer-88932",
      "label": "GitHub Security Advisory GHSA-3pph-fpjx-jg34",
      "url": "https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-14T00:00:00.000Z"
    },
    {
      "id": "openjsf-cna",
      "label": "OpenJS Foundation CNA advisories",
      "url": "https://cna.openjsf.org/security-advisories.html",
      "sourceType": "maintainer_advisory",
      "observedAt": "2026-09-16T00:00:00.000Z"
    },
    {
      "id": "hol-blog-88932",
      "label": "HOL Guard operator write-up",
      "url": "https://hol.org/blog/cve-2026-88932-multer-aborted-upload-orphaned-disk-dos",
      "sourceType": "other_primary",
      "observedAt": "2026-09-16T00:00:00.000Z"
    }
  ],
  "artifacts": [
    {
      "id": "multer",
      "artifactClass": "package",
      "ecosystem": "npm",
      "name": "multer",
      "version": ">=2.2.0 <2.4.0",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "disclosure",
      "occurredAt": "2026-09-14T09:00:26.299Z",
      "eventType": "disclosure",
      "summary": "CVE-2026-88932 / GHSA-3pph-fpjx-jg34 disclosed for multer orphaned disk writes on aborted uploads.",
      "sourceIds": [
        "ghsa-multer-88932",
        "openjsf-cna"
      ]
    },
    {
      "id": "vendor-fix",
      "occurredAt": "2026-09-14T00:00:00.000Z",
      "eventType": "vendor_action",
      "summary": "Fixed in multer 2.4.0 per maintainer advisory.",
      "sourceIds": [
        "ghsa-multer-88932"
      ]
    },
    {
      "id": "hol-publish",
      "occurredAt": "2026-09-16T00:00:00.000Z",
      "eventType": "other",
      "summary": "HOL Guard published the operator blog for CVE-2026-88932 (blog-only social day under feed spacing).",
      "sourceIds": [
        "hol-blog-88932"
      ]
    }
  ],
  "coverage": [],
  "policies": [],
  "limitations": [
    "Only affects disk-storage multer deployments.",
    "Earlier abort-handling fixes do not automatically imply 2.4.0 is installed — check the resolved npm version.",
    "Blog-only promote day; company social may have been deferred under feed spacing."
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-88932-multer-aborted-upload-orphaned-disk-dos/corrections"
}