AIKIDO-2026-153470

TL;DR

multer is an Express middleware for handling multipart/form-data uploads. When it is configured with diskStorage, an aborted or malformed multipart request can leave the partial uploaded file on disk because the stream destroy signal is not propagated to the underlying file write stream. Repeated aborted uploads accumulate orphaned partial files and can exhaust available disk space, resulting in denial of service. The fix tracks in-flight write streams and cleans them up on the abort path so no orphaned partial file is left behind.