---
title: "GHSA-qvfw-j98x-7q72: multer vulnerable to file size limit bypass via async fileFilter race condition"
description: "Low severity. multer vulnerable to file size limit bypass via async fileFilter race condition. Affects multer; fixed in 2.3.0."
url: https://inlinr.com/advisories/GHSA-qvfw-j98x-7q72
lang: en
---

[Packages](https://inlinr.com/packages) / [multer](https://inlinr.com/packages/multer) / [Security](https://inlinr.com/packages/multer/security)

Low Vulnerability GHSA-qvfw-j98x-7q72 CVE-2026-77063 Published 8 Sep 2026

# multer vulnerable to file size limit bypass via async fileFilter race condition

Your version 

Affected releases · [multer](https://inlinr.com/packages/multer)

- 2.x 2.0.0 – 2.2.0 Fixed in 2.3.0
- 1.x and older 0.0.1 – 1.4.4 No fix, no longer updated

On 2.x, the newest line:

```
npm install multer@2.3.0
```

Every release on a timeline

2.x 

1. Affected

2.0.0 – 2.2.0  
6 releases
2. Fixed

2.3.0 – 2.5.0  
3 releases, latest

1.x 

1. Affected

1.0.0 – 1.4.4  
17 releases

0.x 

1. Affected

0.0.1 – 0.1.8  
15 releases

41 stable releases of multer, oldest to newest, one row per major.

## What happens

Impact

When `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed. The `'limit'` event is registered inside the async `fileFilter` callback, so if a file exceeds `limits.fileSize` before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a `LIMIT_FILE_SIZE` error. Applications that rely on `limits.fileSize` to reject oversized uploads are affected on all upload methods (`.single()`, `.array()`, `.fields()`, `.any()`). Uploads using a synchronous `fileFilter` are not affected.

Patches

Users should upgrade to `2.3.0`.

Workarounds

Use a synchronous `fileFilter`, or validate the uploaded file size after the upload completes.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: low
- **Availability**: none

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:L/​A:N

## References

- [Reference](https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72 "https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72")  
github.com/expressjs/multer/security/advisories…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-77063 "https://nvd.nist.gov/vuln/detail/CVE-2026-77063")  
nvd.nist.gov/vuln/detail/CVE-2026-77063
- [Fix commit](https://github.com/expressjs/multer/commit/ab6aeae650328cf31799dcfa4c3e116ba8faaacc "https://github.com/expressjs/multer/commit/ab6aeae650328cf31799dcfa4c3e116ba8faaacc")  
ab6aeae
- [Reference](https://cna.openjsf.org/security-advisories.html "https://cna.openjsf.org/security-advisories.html")  
cna.openjsf.org/security-advisories.html
- [Package](https://github.com/expressjs/multer "https://github.com/expressjs/multer")  
github.com/expressjs/multer
- [Reference](https://github.com/expressjs/multer/releases/tag/v2.3.0 "https://github.com/expressjs/multer/releases/tag/v2.3.0")  
github.com/expressjs/multer/releases/tag/v2.3.0