CVE-2026-3304
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to tr
CVSS
7.5
Alto
EPSS
0.7%
p48
KEV
—
Exploit Today
14
0-100
Publicado: 27 feb 2026 · Última mod.: 15 jul 2026 · CWE-459
0.7%EPSS · 30 días0.7%
2026-06-302026-07-16
Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.
- cna.openjsf.orghttps://cna.openjsf.org/security-advisories.html
- github.comhttps://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee
- github.comhttps://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p
- www.cve.orghttps://www.cve.org/CVERecord?id=CVE-2026-3304
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:6174
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2026:6802
- access.redhat.comhttps://access.redhat.com/security/cve/CVE-2026-3304
- bugzilla.redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2443353
- security.access.redhat.comhttps://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3304.json
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2025-607307.6 ALT18.1%
——5PerfreeBlog v4.0.11 has an arbitrary file deletion vulnerability in the unInstallTheme function12dCVE-2026-115767.5 ALT17.8%
——5The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption.15dCVE-2026-538674.3 MED8.1%
——2Capgo before 12.128.2 fails to delete previously uploaded profile images from backend storage when users replace or remove them. Attackers can access orphaned image files through previously generated URLs, allowing unauthorized retrieval of user-uploaded content.3dCVE-2026-76397.8 ALT2.4%
——1Software installed and run as a non-privileged user may conduct a sequence of improper GPU system calls causing use after free, which helps in facilitating unprivileged memory access from a shader code.
Triggering failure path in the MMU mapping logic by a malicious code could lead to incomplete cleanup of an internal driver state, allowing for future unauthorized access to the contents of the physical memory.4d