AIKIDO-2026-702913

TL;DR

The multipart parser saves uploaded parts to temporary files through saveRequestFiles() on routes that accept more than one part. When a client completes one part, begins a later part, and then disconnects, the save promise rejects while the async iterator advances past the completed part, so already-written temporary files are left on disk outside the per-file cleanup path. Unauthenticated requests can repeat this to cause linear disk growth and exhaust available disk space. The fix relocates cleanup into an outer error handler so temporary files from earlier completed parts are removed when iteration fails.