Multer's diskStorage engine has a vulnerability where aborted multipart uploads can leave orphaned files on disk. This occurs in a brief window before the storage engine assigns the file path, allowing unauthenticated attackers to cause denial of service by exhausting disk space. The issue affects versions from 2.2.0 up to but not including 2.4.0. The vulnerability is a partial regression of a previous fix (CVE-2026-5038). No workarounds are available, but upgrading to version 2.4.0 or higher resolves the issue.