CVE-2026-2359 — Vulnetix

CVE-2026-2359 PUBLISHED CVSS 8.699999809265137 HIGH

Multer vulnerable to Denial of Service via resource exhaustion

EPSS 0.02% · 5.4th percentile

Risk Scores

CVSS 4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.02%

5.4th percentile

Affected Products

Vendor	Product	Versions
expressjs	multer	0, 0.0.0, 0
npm	multer	0, 0, 0

Exploit Intelligence

CIRCL seen: CVE-2026-2359 (circl-sighting)
CIRCL seen: CVE-2026-2359 (circl-sighting)
CIRCL seen: CVE-2026-2359 (circl-sighting)
https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc (circl)
https://www.cve.org/CVERecord?id=CVE-2026-2359 (circl)
https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab (circl)
https://cna.openjsf.org/security-advisories.html (circl)
server.js (github-poc)
server.js (github-poc)
CVE-2026-3304.json (github-poc)

…and 18 more exploits

Timeline

Feb 11, 2026 CVE ID Reserved
Feb 27, 2026 PoC Published
Feb 27, 2026 CVE Published
Feb 27, 2026 PoC Published
Feb 27, 2026 CVE Updated
Feb 28, 2026 EPSS Score
Mar 1, 2026 EPSS Score
Mar 1, 2026 PoC Published
Mar 3, 2026 EPSS Score
Mar 4, 2026 EPSS Score
Mar 6, 2026 EPSS Score
Mar 7, 2026 EPSS Score

References

Open in Interactive Console →

$ Console Community · 100/wk Open console ›