CVE-2026-3304 is a high-severity vulnerability in the expressjs Multer middleware for Node.js, affecting versions prior to 2.1.0. It is classified under CWE-459, which involves incomplete cleanup leading to resource exhaustion. An attacker can trigger a Denial of Service by sending malformed multipart/form-data requests, causing the server to exhaust resources. The vulnerability has a CVSS 4.0 base score of 8.7, indicating network attack vector, no privileges or user interaction required, and high impact on availability. The vendor advisory from Red Hat confirms the issue and recommends upgrading to Multer 2.1.0. No alternative mitigations or workarounds are documented.

Successful exploitation of this vulnerability results in Denial of Service due to resource exhaustion on servers running vulnerable versions of Multer. This can disrupt availability of applications relying on Multer for handling multipart/form-data. There are no known exploits in the wild at this time.

Upgrade Multer to version 2.1.0 or later, where this vulnerability is patched. No known workarounds exist. Since this is not a cloud service, remediation depends on user action to update the software.