StackRadar

CVE-2026-5038

Medium

Advisory

Published 17 Jun 2026In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.3
base score, highest
EPSS
0.003
20th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
32
of 17,781 indexed, latest versions
Container images
28
deployed by those charts
Fix available
1 of 1
affected package

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Carried by container images the latest versions of 32 of 17,781 indexed charts deploy, on 28 images.

Affected packageAffected versionsFixed inImages
multernpm2.0.1, 2.0.2, 2.1.12.2.028
OSV records
GHSA-3p4h-7m6x-2hcm

Charts affected

32 by stars
ChartLatestAffected imagesRadar Score
node-rednode-redVerified publisher0.40.21 of 1See more

node-red node-red 0.40.2

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
nodered/node-red:4.1.2216e7403aab9
multer@2.0.2
2.2.0

Open the chart page →

2,172
servarrkubitodevVerified publisher1.5.21 of 10See more

servarr kubitodev 1.5.2

1 of the 10 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:latestf4768de5f616
multer@2.1.1
2.2.0

Open the chart page →

3,004
redisinsightredisinsight-guiVerified publisher1.3.51 of 1See more

redisinsight redisinsight-gui 1.3.5

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
redis/redisinsight:3.8b5e19ee240ab
multer@2.0.2
2.2.0

Open the chart page →

1,038
nocodbzekker6Verified publisher1.10.01 of 1See more

nocodb zekker6 1.10.0

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
nocodb/nocodb:0.301.5d9516f0bf546
multer@2.0.2
2.2.0

Open the chart page →

4,016
seerrbdclark-helm-chartsVerified publisher0.1.51 of 1See more

seerr bdclark-helm-charts 0.1.5

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
multer@2.1.1
2.2.0

Open the chart page →

1,991
enbuildenbuildVerified publisher0.0.502 of 6See more

enbuild enbuild 0.0.50

2 of the 6 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
multer@2.1.1
2.2.0
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
multer@2.1.1
2.2.0

Open the chart page →

31,510
ghostfolioghostfolioVerified publisher0.5.41 of 3See more

ghostfolio ghostfolio 0.5.4

1 of the 3 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
multer@2.1.1
2.2.0

Open the chart page →

3,123
immichimmich-helm0.3.01 of 4See more

immich immich-helm 0.3.0

1 of the 4 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
multer@2.0.2
2.2.0

Open the chart page →

15,712
n8nn8n-helm2.25.71 of 1See more

n8n n8n-helm 2.25.7

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
n8nio/n8n:2.25.7761374d4eb84
multer@2.1.1
2.2.0

Open the chart page →

2,575
patchworkpatchworkVerified publisher0.8.61 of 2See more

patchwork patchwork 0.8.6

1 of the 2 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/patchwork:mainc01e018bced4
multer@2.0.1
2.2.0

Open the chart page →

2,083
peertubepeertubeVerified publisher0.1.31 of 1See more

peertube peertube 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
chocobozzz/peertube:v8.1.5052712130691
multer@2.1.1
2.2.0

Open the chart page →

7,035
rocketadminrocketadminOfficialVerified publisher1.0.421 of 1See more

rocketadmin rocketadmin 1.0.42

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
rocketadmin/rocketadmin:1.17.710955ef540b9
multer@2.1.1
2.2.0

Open the chart page →

5,482
vaultwarden-kubernetes-secretsvaultwarden-kubernetes-secrets0.0.0-main1 of 2See more

vaultwarden-kubernetes-secrets vaultwarden-kubernetes-secrets 0.0.0-main

1 of the 2 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
multer@2.0.2
2.2.0

Open the chart page →

4,010
ghostchart-ghost0.1.51 of 2See more

ghost chart-ghost 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
library/ghost:6.22.0-alpine3.23ac533a6988ee
multer@2.1.1
2.2.0

Open the chart page →

4,083
dapr-agentsdapr-agents-devVerified publisher0.1.51 of 31See more

dapr-agents dapr-agents-dev 0.1.5

1 of the 31 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.2.0

Open the chart page →

22,193
business-api-ecosystemfiware1.1.01 of 4See more

business-api-ecosystem fiware 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
multer@2.0.1
2.2.0

Open the chart page →

64,489
onboarding-portalfiware1.4.31 of 1See more

onboarding-portal fiware 1.4.3

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
quay.io/seamware/onboarding:0.2.2b406475f9f00
multer@2.0.2
2.2.0

Open the chart page →

1,489
ghostjanip81-helm-chartsVerified publisher0.1.21 of 1See more

ghost janip81-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
library/ghost:6.37.01ef2e532ca4d
multer@2.1.1
2.2.0

Open the chart page →

3,436
ghostk8s-home-lab-repo4.1.01 of 1See more

ghost k8s-home-lab-repo 4.1.0

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
library/ghost:6.41.129773d6be407
multer@2.1.1
2.2.0

Open the chart page →

3,092
zwave-js-uik8sonlabVerified publisher0.7.121 of 1See more

zwave-js-ui k8sonlab 0.7.12

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
zwavejs/zwave-js-ui:11.22.314d018bb689e
multer@2.0.2
2.2.0

Open the chart page →

973
redisinsightklicktippVerified publisher0.5.01 of 1See more

redisinsight klicktipp 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
redis/redisinsight:3.2.055542a762210
multer@2.0.2
2.2.0

Open the chart page →

1,290
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
multer@2.1.1
2.2.0

Open the chart page →

2,756
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
multer@2.1.1
2.2.0

Open the chart page →

1,809
redisinsightlogic3579Verified publisher3.4.01 of 1See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
redis/redisinsight:3.485562d67a912
multer@2.0.2
2.2.0

Open the chart page →

1,490
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
multer@2.1.1
2.2.0

Open the chart page →

4,960
redisinsightredisinsightVerified publisher0.1.01 of 1See more

redisinsight redisinsight 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.2.0

Open the chart page →

1,038
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
multer@2.1.1
2.2.0

Open the chart page →

1,991
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
multer@2.0.1
2.2.0

Open the chart page →

1,313
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.2.0

Open the chart page →

4,661
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
multer@2.0.2
2.2.0

Open the chart page →

2,620
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
multer@2.0.2
2.2.0

Open the chart page →

3,746
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-5038.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
multer@2.0.1
2.2.0

Open the chart page →

5,984

Container images carrying it

28 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
redis/redisinsight:3.8:latestb5e19ee240ab
multer@2.0.2
2.2.0
4
ghcr.io/seerr-team/seerr:latest:v3.4.1f4768de5f616
multer@2.1.1
2.2.0
3
chocobozzz/peertube:v8.1.5052712130691
multer@2.1.1
2.2.0
1
evoapicloud/evolution-api:latest966625532d90
multer@2.0.2
2.2.0
1
fiware/biz-ecosystem-logic-proxy:11.20.3d551a13e8278
multer@2.0.1
2.2.0
1
ghostfolio/ghostfolio:3.7.0e3c6ab53e49b
multer@2.1.1
2.2.0
1
library/ghost:6.37.01ef2e532ca4d
multer@2.1.1
2.2.0
1
library/ghost:6.25.12654b1e90413
multer@2.1.1
2.2.0
1
library/ghost:6.41.129773d6be407
multer@2.1.1
2.2.0
1
library/ghost:6.39.0-alpine77196da4b0df
multer@2.1.1
2.2.0
1
library/ghost:6.22.0-alpine3.23ac533a6988ee
multer@2.1.1
2.2.0
1
n8nio/n8n:2.25.7761374d4eb84
multer@2.1.1
2.2.0
1
nocodb/nocodb:0.301.5d9516f0bf546
multer@2.0.2
2.2.0
1
nodered/node-red:4.1.2216e7403aab9
multer@2.0.2
2.2.0
1
nodered/node-red:4.1.10-minimald73ae167cb9b
multer@2.1.1
2.2.0
1
redis/redisinsight:3.2.055542a762210
multer@2.0.2
2.2.0
1
redis/redisinsight:3.485562d67a912
multer@2.0.2
2.2.0
1
rocketadmin/rocketadmin:1.17.710955ef540b9
multer@2.1.1
2.2.0
1
sigp/siren:v3.0.42c219b04758e
multer@2.0.1
2.2.0
1
zimengxiong/excalidash-backend:0.4.271273af713c91
multer@2.0.2
2.2.0
1
zwavejs/zwave-js-ui:11.22.314d018bb689e
multer@2.0.2
2.2.0
1
ghcr.io/antoniolago/vaultwarden-kubernetes-secrets:0.0.0-main13e267ad7d94
multer@2.0.2
2.2.0
1
ghcr.io/bryopsida/patchwork:mainc01e018bced4
multer@2.0.1
2.2.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
multer@2.0.2
2.2.0
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
multer@2.0.1
2.2.0
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
multer@2.0.2
2.2.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
multer@2.1.1
2.2.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
multer@2.1.1
2.2.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.