multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
41 stable releases, newest first, by release line. Notes are quoted as the maintainers published them.
- 2.x · latest line
2.5.0
22 Oct 2026- security
Don't add a failed upload to the abort cleanup list
Allow a field value exactly at the fieldSize limit
Important: Security
- security
What's Changed
Don't add a failed upload to the abort cleanup list
Allow a field value exactly at the fieldSize limit
2.4.0
14 Sep 2026- security
Feat. improve wording for LIMIT_UNEXPECTED_FILE error code
Add filename to file errors
Highlights
multer finally supports Google Cloud Functions and Firebase 🎉
These platforms read the request body before your code runs, so multer's classic
req.pipe(busboy)received nothing: emptyreq.body, emptyreq.files, and nearly a decade of duplicated issues.The new
streamHandleroption closes that gap: you decide how the body reaches the parser, so the pre-readrawBodyjust works (see image).const multer = require('multer') const upload = multer({ storage: multer.memoryStorage(), streamHandler: (req, busboy) => { // Cloud Functions / Firebase expose the pre-read body here if (req.rawBody) busboy.end(req.rawBody) else req.pipe(busboy) } }) app.post('/upload', upload.single('file'), (req, res) => { res.json({ name: req.file.originalname, size: req.file.size }) })This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.
Important: Security
- security
What's Changed
Feat. improve wording for LIMIT_UNEXPECTED_FILE error code
Add filename to file errors
Reject non-integer fileSize limits
Allow exactly limits.parts parts
Do not consume maxCount for files skipped by fileFilter
Validate all limits at construction time
Accept a function for limits
Add flush option to disk storage to fsync files before completion
Expose busboy defCharset, highWaterMark and fileHwm options
Wait for the flush descriptor before unlinking on aborted uploads
Reserve the maxCount slot before yielding to an async fileFilter
Add streamHandler option to feed busboy from pre-consumed bodies
Decode escaped field names, not just filenames
Report the decoded filename on LIMIT_FILE_SIZE
Allow diskStorage without options
2.3.0
28 Aug 2026- security
- security
- security
Important
- security
- security
- security
- security
What's Changed
Update busboy link pointing to nonexistent section
Update outdated links to Express error handling guide
Normalize package.json
Fallback to error code when no message mapping exists
Prevent process crash when fileFilter calls its callback more than once
Preserve async hooks context in supported environments
Allow files at exact fileSize limit
Decode WHATWG-escaped characters in file originalname
Update 'README-zh-cn.md' up to now
Add an opt-in fieldArrayIndexLimit
2.2.0
15 Jun 2026- security
- security
Important
- security
- security
2.1.1
4 Mar 2026- security
Fix error/abort handling
2.1.0
27 Feb 2026- security
- security
headers-support-utf8
Important
- security
- security
What's Changed
headers-support-utf8
Add Turkish translation (README-tr.md)
2.0.2
17 Jul 2025- security
2.0.1
3 Jun 2025- security
Add Arabic translation for README ..
Update README.md to fix issue #1114
Important
- security
What's Changed
Add Arabic translation for README ..
Update README.md to fix issue #1114
Improved documentation translation to Spanish
Translated to french
Improve the Brazilian Portuguese translation
Fix a mistake with README-pt-br.md
Update in Readme-pt-br and fix in Readme-ko
Documentation: Remove unfortunate abbreviation from readme
Update readme badges
📝 fix changelog information
Master -> v2
Remove --save from README
Feat - update link badge in docs
♻️ use version tag for CI, fix CI badge, fix references to master/main
📝 list languages in table to prevent GH right-aligning list due to RTL language
Apply security best practices
2.0.0
19 May 2025- breaking
The minimum supported Node version is now 10.16.0
- security
- security
Important
- breaking
The minimum supported Node version is now 10.16.0
- security
- security
What's Changed
- breaking
🐛 drain stream. fixes regression in node 18, remove old CI, set minimum node version, fix readme badges, add .npmrc
Handle two busboy error events
♻️ fully drain stream
🥅 explicitly handle req error
🚨 lint:fix
⬆️ bump mocha
- 1.x
1.4.4
7 Dec 2021Bugfix: Handle missing field names
Bugfix: Handle missing field names
1.4.3
9 Aug 2021Bugfix: Avoid deprecated pseudoRandomBytes function
Bugfix: Avoid deprecated pseudoRandomBytes function
1.4.2
16 Jul 2019Maintenance only: docs, tests, build or refactoring. Nothing changes in how you use it.
1.4.1
11 Oct 2018Bugfix: Make sure that req.file.buffer always is a Buffer
1.4.0
26 Sep 2018Make Multer errors inherit from MulterError
1.3.1
28 Jun 2018Bugfix: Bump vulnerable dependency
1.3.0
25 Jan 2017Expose preservePath option
1.2.1
14 Dec 2016Bugfix: Prevent Multiple Errors from Crashing
1.2.0
4 Aug 2016Add .none() for accepting only fields
1.1.0
23 Oct 2015Accept any file, regardless of fieldname
1.0.6
3 Oct 2015Bugfix: Always report limit errors
1.0.5
19 Sep 2015Bugfix: Drain the stream before considering request done
1.0.4
19 Sep 2015Bugfix: Propagate all errors from busboy
1.0.3
6 Aug 2015Bugfix: Ensure file order is correct
1.0.2
6 Aug 2015Bugfix: Don't hang when hitting size limit
1.0.1
20 Jul 2015Bugfix: Decrement pending writes on error
1.0.0
18 Jul 2015Introduce storage engines
Specify expected fields
Follow the W3C JSON form spec
- 0.1.x
- 0.0.x