multer

Important: Security

• security

  Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)

What's Changed

• Don't add a failed upload to the abort cleanup list

• Allow a field value exactly at the fieldSize limit

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')

const upload = multer({
  storage: multer.memoryStorage(),
  streamHandler: (req, busboy) => {
    // Cloud Functions / Firebase expose the pre-read body here
    if (req.rawBody) busboy.end(req.rawBody)
    else req.pipe(busboy)
  }
})

app.post('/upload', upload.single('file'), (req, res) => {
  res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• security

  Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• Feat. improve wording for LIMIT_UNEXPECTED_FILE error code

• Add filename to file errors

• Reject non-integer fileSize limits

• Allow exactly limits.parts parts

• Do not consume maxCount for files skipped by fileFilter

• Validate all limits at construction time

• Accept a function for limits

• Add flush option to disk storage to fsync files before completion

• Expose busboy defCharset, highWaterMark and fileHwm options

• Wait for the flush descriptor before unlinking on aborted uploads

• Reserve the maxCount slot before yielding to an async fileFilter

• Add streamHandler option to feed busboy from pre-consumed bodies

• Decode escaped field names, not just filenames

• Report the decoded filename on LIMIT_FILE_SIZE

• Allow diskStorage without options

Important

• security

  Fix CVE-2026-77078 (GHSA-wc9g-mqfw-jrwm)

• security

  Fix CVE-2026-77037 (GHSA-qfvm-cv95-jqjf)

• security

  Fix CVE-2026-77063 (GHSA-qvfw-j98x-7q72)

• security

  Fix CVE-2026-82333 (GHSA-535w-7cp7-47q4)

What's Changed

• Update busboy link pointing to nonexistent section

• Update outdated links to Express error handling guide

• Normalize package.json

• Fallback to error code when no message mapping exists

• Prevent process crash when fileFilter calls its callback more than once

• Preserve async hooks context in supported environments

• Allow files at exact fileSize limit

• Decode WHATWG-escaped characters in file originalname

• Update 'README-zh-cn.md' up to now

• Add an opt-in fieldArrayIndexLimit