{"type":"bundle","id":"bundle--0e22465f-76a5-5190-9b6a-f403d8b2f3f7","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--4fd4d523-d3ec-5fe5-aff2-1a941cbb0922","created":"2026-09-20T13:02:24.590Z","modified":"2026-09-20T13:02:09.847Z","name":"Multer aborted uploads leave orphaned disk files","description":"multer 2.2.0–2.3.0 on disk storage can leave orphaned files when a multipart upload is aborted after multer's abort cleanup already ran, so repeated abort storms fill the disk. Upgrade to multer 2.4.0. This is a follow-on class after earlier abort-handling work, not the same bug as the prior 5038-era fix alone.","aliases":["CVE-2026-88932","multer orphaned disk DoS"],"first_seen":"2026-09-14T09:00:26.299Z","last_seen":"2026-09-16T00:00:00.000Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"GitHub Security Advisory GHSA-3pph-fpjx-jg34","url":"https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"},{"source_name":"OpenJS Foundation CNA advisories","url":"https://cna.openjsf.org/security-advisories.html"},{"source_name":"HOL Guard operator write-up","url":"https://hol.org/blog/cve-2026-88932-multer-aborted-upload-orphaned-disk-dos"}]}]}