multer

Highlights

multer finally supports Google Cloud Functions and Firebase 🎉

These platforms read the request body before your code runs, so multer's classic req.pipe(busboy) received nothing: empty req.body, empty req.files, and nearly a decade of duplicated issues.

The new streamHandler option closes that gap: you decide how the body reaches the parser, so the pre-read rawBody just works (see image).

const multer = require('multer')

const upload = multer({
  storage: multer.memoryStorage(),
  streamHandler: (req, busboy) => {
    // Cloud Functions / Firebase expose the pre-read body here
    if (req.rawBody) busboy.end(req.rawBody)
    else req.pipe(busboy)
  }
})

app.post('/upload', upload.single('file'), (req, res) => {
  res.json({ name: req.file.originalname, size: req.file.size })
})

This landed thanks to community PRs going back to 2017; their authors are credited as co-authors in the release.

Important: Security

• security

  Fix CVE-2026-88932 (GHSA-3pph-fpjx-jg34)

What's Changed

• Feat. improve wording for LIMIT_UNEXPECTED_FILE error code

• Add filename to file errors

• Reject non-integer fileSize limits

• Allow exactly limits.parts parts

• Do not consume maxCount for files skipped by fileFilter

• Validate all limits at construction time

• Accept a function for limits

• Add flush option to disk storage to fsync files before completion

• Expose busboy defCharset, highWaterMark and fileHwm options

• Wait for the flush descriptor before unlinking on aborted uploads

• Reserve the maxCount slot before yielding to an async fileFilter

• Add streamHandler option to feed busboy from pre-consumed bodies

• Decode escaped field names, not just filenames

• Report the decoded filename on LIMIT_FILE_SIZE

• Allow diskStorage without options