---
title: "multer 2.5.0"
description: "Latest published version of multer is 2.5.0, licensed MIT. Current as of our last registry check."
url: https://inlinr.com/packages/multer
lang: en
---

[Packages](https://inlinr.com/packages)

# multer

2.5.0 · 22 Oct 2026 MIT 30.7M / week [Repository](https://github.com/expressjs/multer) [Homepage](https://github.com/expressjs/multer#readme) [npm](https://www.npmjs.com/package/multer) [Atom feed](https://inlinr.com/packages/feed/multer)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/multer/upgrade)

LineNewestSecurity

- 2.x 2.5.0 Safe from 2.5.0 Latest line
- 1.x and older 1.4.4 25 open advisories, worst high  · last release Dec 2021, no longer updated [To 2.5.0](https://inlinr.com/packages/multer/upgrade/1.4.4-2.5.0)

## Latest releases

[All 41 releases](https://inlinr.com/packages/multer/releases)

1. 2.x · latest line
2. ### [2.5.0](https://inlinr.com/packages/multer/releases/2.5.0 "Open this release") [](https://github.com/expressjs/multer/releases/tag/v2.5.0 "Read this release where it was published")  
22 Oct 2026

  - security  
  Fix [CVE-2026-113872](https://www.cve.org/CVERecord?id=CVE-2026-113872 "https://www.cve.org/CVERecord?id=CVE-2026-113872") ([GHSA-q7qp-rjg7-q26m](https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m "https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m"))
  - Don't add a failed upload to the abort cleanup list
  - Allow a field value exactly at the fieldSize limit
3. ### [2.4.0](https://inlinr.com/packages/multer/releases/2.4.0 "Open this release") [](https://github.com/expressjs/multer/releases/tag/v2.4.0 "Read this release where it was published")  
14 Sep 2026

  - security  
  Fix [CVE-2026-88932](https://www.cve.org/CVERecord?id=CVE-2026-88932 "https://www.cve.org/CVERecord?id=CVE-2026-88932") ([GHSA-3pph-fpjx-jg34](https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34 "https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34"))
  - Feat. improve wording for LIMIT\_UNEXPECTED\_FILE error code
  - Add filename to file errors
4. ### [2.3.0](https://inlinr.com/packages/multer/releases/2.3.0 "Open this release") [](https://github.com/expressjs/multer/releases/tag/v2.3.0 "Read this release where it was published")  
28 Aug 2026

  - security  
  Fix [CVE-2026-77078](https://www.cve.org/CVERecord?id=CVE-2026-77078 "https://www.cve.org/CVERecord?id=CVE-2026-77078") ([GHSA-wc9g-mqfw-jrwm](https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm "https://github.com/expressjs/multer/security/advisories/GHSA-wc9g-mqfw-jrwm"))
  - security  
  Fix [CVE-2026-77037](https://www.cve.org/CVERecord?id=CVE-2026-77037 "https://www.cve.org/CVERecord?id=CVE-2026-77037") ([GHSA-qfvm-cv95-jqjf](https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf "https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf"))
  - security  
  Fix [CVE-2026-77063](https://www.cve.org/CVERecord?id=CVE-2026-77063 "https://www.cve.org/CVERecord?id=CVE-2026-77063") ([GHSA-qvfw-j98x-7q72](https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72 "https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72"))

Dependency tracking · free for 3 projects

## Know when your own dependencies move

multer had 11 security advisories in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[All 15](https://inlinr.com/packages/multer/security)

- [multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown](https://inlinr.com/advisories/GHSA-q7qp-rjg7-q26m) High · fixed in 2.5.0
- [multer vulnerable to Denial of Service via crafted multipart field names](https://inlinr.com/advisories/GHSA-wc9g-mqfw-jrwm) High · fixed in 2.3.0
- [multer vulnerable to Denial of Service via file descriptor leak on aborted uploads](https://inlinr.com/advisories/GHSA-qfvm-cv95-jqjf) High · fixed in 2.3.0

## Health

[Details](https://inlinr.com/packages/multer/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.