AIKIDO-2026-606532

TL;DR

Multer's disk storage engine writes uploaded files through a write stream. When a disk-backed upload is aborted or truncated before the stream finishes, the engine removes the visible file but leaves the underlying write file descriptor open. Repeated aborted or malformed multipart uploads each leak a descriptor and retain disk blocks until the process exits, exhausting resources and causing a denial of service. The fix destroys the destination write stream on abnormal source termination and defers cleanup until the stream has closed.