CVE-2026-77063
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
multer before version 2.3.0 has a race condition vulnerability in file stream handling when an asynchronous fileFilter is used together with the fileSize limit. This allows bypassing the rejection of files exceeding the size limit.
Risk Assessment
The risk is that files larger than the allowed limit may be accepted by the application, potentially violating file upload policies, although the parser still truncates the stream, so it does not cause uncontrolled resource consumption.
Recommendation
It is recommended to upgrade multer to version 2.3.0, which includes a fix for this vulnerability.
Other vulnerabilities in multer
See all- CVE-2026-82333High
Vulnerability in multer (Node.js middleware) before version 2.3.0. A crafted multipart request with two fields can block the event loop, causing denial of service. Version 2.3.0 adds fieldArrayIndexLimit option to reject oversized array indexes.
- CVE-2026-77078High
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric array index to allocate a maximum-length sparse array, and a second field then pushes past that length, which throws inside the append-field dependency and is not caught by multer. All versions before 2.3.0 are affected, and the issue is a remotely triggerable denial of service. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
- CVE-2026-77037High
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor, leaving a deleted but still open descriptor. A remote attacker able to reach an upload route using the built-in disk storage can send repeated aborted or malformed multipart uploads, each one leaking a file descriptor and retaining disk blocks until the process exits, which can exhaust resources and cause a denial of service. The issue is fixed in multer 2.3.0, which closes the destination write stream on abnormal source termination and defers cleanup until the stream has closed. Upgrade to multer 2.3.0 to remediate.
- CVE-2026-5038Medium
Multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk, potentially exhausting disk space.
- CVE-2026-5079High
Multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. An attacker can exploit this to force allocation of deeply nested object structures, consuming CPU and memory.
- CVE-2026-3520High
A vulnerability in Multer (node.js) prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.
- CVE-2026-3304High
Multer is a Node.js middleware for handling multipart/form-data. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.
- CVE-2026-2359High
Multer is a Node.js middleware for handling `multipart/form-data`. A vulnerability in versions prior to 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping the connection during file upload, potentially causing resource exhaustion.
Original NVD description (English source)
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.