The multer Node.js middleware contains a critical resource exhaustion vulnerability that allows unauthenticated attackers to cause a denial of service by leaking file descriptors.

This is an uncontrolled resource consumption and incomplete cleanup flaw occurring when multipart uploads are aborted. An unauthenticated remote attacker can trigger this state by sending repeated malformed or aborted upload requests, forcing the application to retain open file descriptors and disk space until exhaustion.

The exploitation of this vulnerability leads to a denial of service, rendering the affected application unavailable to legitimate users. With a CVSS score of 7.5, this high severity flaw poses a significant operational risk to organizations relying on Node.js services for file processing, potentially resulting in system downtime and degraded service reliability.

Immediate Action: Update the multer dependency to version 2.3.0 or later to ensure proper cleanup of write streams and file descriptors.

Proactive Monitoring: Monitor server resource utilization, specifically file descriptor counts and disk space, for sudden, anomalous spikes that could indicate an ongoing denial of service attack.

Compensating Controls: Implement rate limiting and request size validation on all file upload endpoints to restrict the volume of requests an attacker can submit, effectively limiting the scope of resource exhaustion.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this vulnerability and the ease with which an unauthenticated attacker can exhaust system resources, immediate action is required. Organizations should prioritize updating the multer middleware to version 2.3.0 across all affected environments to eliminate the risk of denial of service.