multer vulnerable to file size limit bypass via async fileFilter race condition
Affected releases · multer
- 2.x2.0.0 – 2.2.0Fixed in 2.3.0
- 1.x and older0.0.1 – 1.4.4No fix, no longer updated
On 2.x, the newest line:
npm install multer@2.3.0Every release on a timeline
Affected
2.0.0 – 2.2.0
6 releases
Fixed
2.3.0 – 2.5.0
3 releases, latest
Affected
1.0.0 – 1.4.4
17 releases
Affected
0.0.1 – 0.1.8
15 releases
What happens
Impact
When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a LIMIT_FILE_SIZE error. Applications that rely on limits.fileSize to reject oversized uploads are affected on all upload methods (.single(), .array(), .fields(), .any()). Uploads using a synchronous fileFilter are not affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
Use a synchronous fileFilter, or validate the uploaded file size after the upload completes.