{"items":[{"id":"NVI-00013178","kind":"vulnerability","title":"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-3pph-fpjx-jg34","CVE-2026-88932"],"plain_summary":"GitHub lists this reviewed advisory for multer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-185480be12d92352b8afadfc88cf126c"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-28T21:34:59.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-862063bc8c15a121620882a4563d41c9"},{"kind":"CVSS","as_of":"2026-09-16T19:40:00.317Z","value":"5.3 MEDIUM (3.1)","meaning":"ce714d77-add3-4f53-aff5-83d477b104bb severity; no combined Null risk score.","source_id":"sr-185480be12d92352b8afadfc88cf126c"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-862063bc8c15a121620882a4563d41c9","url":"https://github.com/advisories/GHSA-3pph-fpjx-jg34","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3pph-fpjx-jg34","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"},{"id":"sr-185480be12d92352b8afadfc88cf126c","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88932","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-88932","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-04T09:59:30.678Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-862063bc8c15a121620882a4563d41c9"],"technology":"multer","known_exclusions":[],"conditions_summary":"### Impact\n\nMulter's `diskStorage` can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the shared system temporary directory is exhausted. An asynchronous `destination` or `filename` widens the window.\n\n### Patches\n\nUsers should upgrade to `2.4.0` or higher.\n\n### Workarounds\n\nNone.","public_affected_ranges":[">= 2.2.0, < 2.4.0"]}],"null_published_at":"2026-11-04T10:04:35.915Z","source_updated_at":"2026-09-28T21:34:59.000Z","source_disclosed_at":"2026-09-28T21:34:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-01T07:24:25.558Z"},{"id":"NVI-00013178","kind":"vulnerability","title":"multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-3pph-fpjx-jg34","CVE-2026-88932"],"plain_summary":"GitHub lists this reviewed advisory for multer. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-862063bc8c15a121620882a4563d41c9"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-28T21:34:59.000Z","value":"5.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-862063bc8c15a121620882a4563d41c9"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-862063bc8c15a121620882a4563d41c9","url":"https://github.com/advisories/GHSA-3pph-fpjx-jg34","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-3pph-fpjx-jg34","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:24:25.558Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-862063bc8c15a121620882a4563d41c9"],"technology":"multer","known_exclusions":[],"conditions_summary":"### Impact\n\nMulter's `diskStorage` can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the shared system temporary directory is exhausted. An asynchronous `destination` or `filename` widens the window.\n\n### Patches\n\nUsers should upgrade to `2.4.0` or higher.\n\n### Workarounds\n\nNone.","public_affected_ranges":[">= 2.2.0, < 2.4.0"]}],"null_published_at":"2026-11-01T07:29:12.928Z","source_updated_at":"2026-09-28T21:34:59.000Z","source_disclosed_at":"2026-09-28T21:34:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:24:25.558Z"}],"next_cursor":null,"snapshot_revision":"42594"}