multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Your version
npm marks 1.4.4 as deprecated: Multer 1.x is affected by CVE-2022-24434. This is fixed in v1.4.4-lts.1 which drops support for versions of Node.js before 6. Please upgrade to at least Node.js 6 and version 1.4.4-lts.1 of Multer. If you need support for older versions of Node.js, we are open to accepting patches that would fix the CVE on the main 1.x release line, whilst maintaining compatibility with Node.js 0.10.
In short
1 fixed2 internal
Security
11 advisories affect 1.4.4; 2.3.0 fixes the others
- Highmulter vulnerable to Denial of Service via crafted multipart field namesGHSA-wc9g-mqfw-jrwm · 8 Sep 2026Fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via oversized array index in field namesGHSA-535w-7cp7-47q4 · 8 Sep 2026Fixed in 2.3.0
- HighMulter vulnerable to Denial of Service via deeply nested field namesGHSA-72gw-mp4g-v24j · 17 Jun 2026Fixed in 2.2.0
- HighMulter Vulnerable to Denial of Service via Uncontrolled RecursionGHSA-5528-5vmv-3xc2 · 5 Mar 2026Fixed in 2.1.1
- HighMulter vulnerable to Denial of Service via incomplete cleanupGHSA-xf7r-hgr6-v32p · 1 Mar 2026Fixed in 2.1.0
6 more
- HighMulter vulnerable to Denial of Service via resource exhaustionGHSA-v52c-386h-88mc · 1 Mar 2026Fixed in 2.1.0
- HighMulter vulnerable to Denial of Service via unhandled exception from malformed requestGHSA-fjgf-rc76-4x9p · 17 Jul 2025Fixed in 2.0.2
- HighMulter vulnerable to Denial of Service via unhandled exceptionGHSA-g5hg-p3ph-g8qg · 5 Jun 2025Fixed in 2.0.1
- HighMulter vulnerable to Denial of Service from maliciously crafted requestsGHSA-4pg4-qvpc-4q3h · 19 May 2025No fix yet
- HighMulter vulnerable to Denial of Service via memory leaks from unclosed streamsGHSA-44fp-w29j-9vj5 · 19 May 2025No fix yet
- Lowmulter vulnerable to file size limit bypass via async fileFilter race conditionGHSA-qvfw-j98x-7q72 · 8 Sep 2026Fixed in 2.3.0
Release note
Bugfix: Handle missing field names