multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Your version
2.5.0 is the newest release of 2.x.
In short
2 security5 internal
Security
Fixes 2 advisories that affected 2.1.1
- HighMulter vulnerable to Denial of Service via deeply nested field namesGHSA-72gw-mp4g-v24j · 17 Jun 2026Fixed in 2.2.0
- ModerateMulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsGHSA-3p4h-7m6x-2hcm · 17 Jun 2026Fixed in 2.2.0
6 advisories affect 2.2.0; 2.5.0 fixes them
- Highmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownGHSA-q7qp-rjg7-q26m · 23 Oct 2026Fixed in 2.5.0
- Highmulter vulnerable to Denial of Service via crafted multipart field namesGHSA-wc9g-mqfw-jrwm · 8 Sep 2026Fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsGHSA-qfvm-cv95-jqjf · 8 Sep 2026Fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via oversized array index in field namesGHSA-535w-7cp7-47q4 · 8 Sep 2026Fixed in 2.3.0
- Moderatemulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsGHSA-3pph-fpjx-jg34 · 28 Sep 2026Fixed in 2.4.0
1 more
- Lowmulter vulnerable to file size limit bypass via async fileFilter race conditionGHSA-qvfw-j98x-7q72 · 8 Sep 2026Fixed in 2.3.0
Release note
Important
- security
- security