Packages / multer / Security

HighVulnerabilityGHSA-5528-5vmv-3xc2CVE-2026-3520Published 5 Mar 2026

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

Your version

Affected releases · multer

  • 2.x2.0.0 – 2.1.0Fixed in 2.1.1
  • 1.x and older0.0.1 – 1.4.4No fix, no longer updated

On 2.x, the newest line:

npm install multer@2.1.1
Every release on a timeline
2.x

  1. Affected

    2.0.0 – 2.1.0

    4 releases

  2. Fixed

    2.1.1 – 2.5.0

    5 releases, latest

1.x

  1. Affected

    1.0.0 – 1.4.4

    17 releases

0.x

  1. Affected

    0.0.1 – 0.1.8

    15 releases

41 stable releases of multer, oldest to newest, one row per major.

What happens

Impact

A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.

Patches

Users should upgrade to 2.1.1

Workarounds

None

Resources