multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Your version
2.5.0 is the newest release of 2.x.
In short
4 security2 new5 fixed3 changed19 internal
Security
Fixes 4 advisories that affected 2.2.0
- Highmulter vulnerable to Denial of Service via crafted multipart field namesGHSA-wc9g-mqfw-jrwm · 8 Sep 2026Fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsGHSA-qfvm-cv95-jqjf · 8 Sep 2026Fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via oversized array index in field namesGHSA-535w-7cp7-47q4 · 8 Sep 2026Fixed in 2.3.0
- Lowmulter vulnerable to file size limit bypass via async fileFilter race conditionGHSA-qvfw-j98x-7q72 · 8 Sep 2026Fixed in 2.3.0
2 advisories affect 2.3.0; 2.5.0 fixes them
- Highmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownGHSA-q7qp-rjg7-q26m · 23 Oct 2026Fixed in 2.5.0
- Moderatemulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsGHSA-3pph-fpjx-jg34 · 28 Sep 2026Fixed in 2.4.0
Release note
Important
- security
- security
- security
- security
What's Changed
Update busboy link pointing to nonexistent section
Update outdated links to Express error handling guide
Normalize package.json
Fallback to error code when no message mapping exists
Prevent process crash when fileFilter calls its callback more than once
Preserve async hooks context in supported environments
Allow files at exact fileSize limit
Decode WHATWG-escaped characters in file originalname
Update 'README-zh-cn.md' up to now
Add an opt-in fieldArrayIndexLimit