multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Your version
1.4.4 is the newest release of 1.x.
npm marks 1.0.0 as deprecated: Multer 1.x is affected by CVE-2022-24434. This is fixed in v1.4.4-lts.1 which drops support for versions of Node.js before 6. Please upgrade to at least Node.js 6 and version 1.4.4-lts.1 of Multer. If you need support for older versions of Node.js, we are open to accepting patches that would fix the CVE on the main 1.x release line, whilst maintaining compatibility with Node.js 0.10.
In short
1 new2 changed
Security
8 advisories affect 1.0.0; 2.3.0 fixes the others
- Highmulter vulnerable to Denial of Service via crafted multipart field namesGHSA-wc9g-mqfw-jrwm · 8 Sep 2026Fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via oversized array index in field namesGHSA-535w-7cp7-47q4 · 8 Sep 2026Fixed in 2.3.0
- HighMulter vulnerable to Denial of Service via deeply nested field namesGHSA-72gw-mp4g-v24j · 17 Jun 2026Fixed in 2.2.0
- HighMulter Vulnerable to Denial of Service via Uncontrolled RecursionGHSA-5528-5vmv-3xc2 · 5 Mar 2026Fixed in 2.1.1
- HighMulter vulnerable to Denial of Service via incomplete cleanupGHSA-xf7r-hgr6-v32p · 1 Mar 2026Fixed in 2.1.0
3 more
- HighMulter vulnerable to Denial of Service via resource exhaustionGHSA-v52c-386h-88mc · 1 Mar 2026Fixed in 2.1.0
- HighMulter vulnerable to Denial of Service via memory leaks from unclosed streamsGHSA-44fp-w29j-9vj5 · 19 May 2025No fix yet
- Lowmulter vulnerable to file size limit bypass via async fileFilter race conditionGHSA-qvfw-j98x-7q72 · 8 Sep 2026Fixed in 2.3.0
Release note
Introduce storage engines
Specify expected fields
Follow the W3C JSON form spec