Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-3304
PUBLISHED
More InfoOfficial Page
Assigner-openjs
Assigner Org ID-ce714d77-add3-4f53-aff5-83d477b104bb
View Known Exploited Vulnerability (KEV) details
Published At-27 Feb, 2026 | 15:44
Updated At-15 Jul, 2026 | 01:07
Rejected At-
â–¼CVE Numbering Authority (CNA)
Multer vulnerable to Denial of Service via incomplete cleanup

Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.

Affected Products
Vendor
Express (OpenJS Foundation)expressjs
Product
multer
Default Status
unaffected
Versions
Affected
  • From 0.0.0 before 2.1.0 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-459CWE-459
Type: CWE
CWE ID: CWE-459
Description: CWE-459
Metrics
VersionBase scoreBase severityVector
4.08.7HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Version: 4.0
Base score: 8.7
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p
N/A
https://www.cve.org/CVERecord?id=CVE-2026-3304
N/A
https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee
N/A
https://cna.openjsf.org/security-advisories.html
N/A
Hyperlink: https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p
Resource: N/A
Hyperlink: https://www.cve.org/CVERecord?id=CVE-2026-3304
Resource: N/A
Hyperlink: https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee
Resource: N/A
Hyperlink: https://cna.openjsf.org/security-advisories.html
Resource: N/A
â–¼Authorized Data Publishers (ADP)
1. CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Replaced By

Rejected Reason

References
HyperlinkResource
2. multer: Multer: Denial of Service via malformed requests

A flaw was found in Multer, a Node.js middleware. A remote attacker could exploit this vulnerability by sending specially crafted malformed requests. This could lead to resource exhaustion, resulting in a Denial of Service (DoS) for the application using Multer.

Affected Products
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Developer Hub 1.8
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhdh/rhdh-hub-rhel9
CPEs
  • cpe:/a:redhat:rhdh:1.8::el9
Default Status
affected
Versions
Unaffected
  • From 1774545605 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Developer Hub 1.9
Collection URL
https://catalog.redhat.com/software/containers/
Package Name
rhdh/rhdh-hub-rhel9
CPEs
  • cpe:/a:redhat:rhdh:1.9::el9
Default Status
affected
Versions
Unaffected
  • From 1775140647 before * (rpm)
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/cluster-logging-operator-bundle
CPEs
  • cpe:/a:redhat:logging:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/cluster-logging-rhel9-operator
CPEs
  • cpe:/a:redhat:logging:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/eventrouter-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/fluentd-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/log-file-metric-exporter-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/logging-view-plugin-rhel9
CPEs
  • cpe:/a:redhat:logging:5
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Logging Subsystem for Red Hat OpenShift
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
openshift-logging/vector-rhel9
CPEs
  • cpe:/a:redhat:logging:5
  • cpe:/a:redhat:logging:6
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
fido-device-onboard
CPEs
  • cpe:/o:redhat:enterprise_linux:10
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
firefox
CPEs
  • cpe:/o:redhat:enterprise_linux:10
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 10
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
thunderbird
CPEs
  • cpe:/o:redhat:enterprise_linux:10
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 7
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
firefox
CPEs
  • cpe:/o:redhat:enterprise_linux:7
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
firefox
CPEs
  • cpe:/o:redhat:enterprise_linux:8
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 8
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
thunderbird
CPEs
  • cpe:/o:redhat:enterprise_linux:8
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
firefox
CPEs
  • cpe:/o:redhat:enterprise_linux:9
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Enterprise Linux 9
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
thunderbird
CPEs
  • cpe:/o:redhat:enterprise_linux:9
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Red Hat Trusted Profile Analyzer
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
rhtpa/rhtpa-trustification-service-rhel9
CPEs
  • cpe:/a:redhat:trusted_profile_analyzer:2
Default Status
unaffected
Vendor
Red Hat, Inc.Red Hat
Product
Self-service automation portal 2
Collection URL
https://access.redhat.com/downloads/content/package-browser/
Package Name
ansible-automation-platform/automation-portal
CPEs
  • cpe:/a:redhat:ansible_portal:2
Default Status
affected
Problem Types
TypeCWE IDDescription
CWECWE-459Incomplete Cleanup
Type: CWE
CWE ID: CWE-459
Description: Incomplete Cleanup
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Red Hat severity rating
value:
Important
namespace:
https://access.redhat.com/security/updates/classification/
Impacts
CAPEC IDDescription
Solutions

RHSA-2026:6174: Red Hat Developer Hub 1.8

RHSA-2026:6802: Red Hat Developer Hub 1.9

Configurations

Workarounds

Exploits

Credits

Timeline
EventDate
Reported to Red Hat.2026-02-27 16:01:39
Made public.2026-02-27 15:44:37
Event: Reported to Red Hat.
Date: 2026-02-27 16:01:39
Event: Made public.
Date: 2026-02-27 15:44:37
Replaced By

Rejected Reason

References
HyperlinkResource
https://access.redhat.com/security/cve/CVE-2026-3304
vdb-entry
x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2443353
issue-tracking
x_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3304.json
x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:6174
vendor-advisory
x_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:6802
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/security/cve/CVE-2026-3304
Resource:
vdb-entry
x_refsource_REDHAT
Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=2443353
Resource:
issue-tracking
x_refsource_REDHAT
Hyperlink: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-3304.json
Resource:
x_sadp-csaf-vex
Hyperlink: https://access.redhat.com/errata/RHSA-2026:6174
Resource:
vendor-advisory
x_refsource_REDHAT
Hyperlink: https://access.redhat.com/errata/RHSA-2026:6802
Resource:
vendor-advisory
x_refsource_REDHAT
Details not found