multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Your version
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
| Line | Newest | Where it stands |
|---|---|---|
| 2.5.0 | Safe from 2.5.0 | |
| 1.4.4 | 25 open advisories, worst high · last release Dec 2021, no longer updated |
- Highmulter vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownGHSA-q7qp-rjg7-q26m · 23 Oct 2026fixed in 2.5.0
- Highmulter vulnerable to Denial of Service via crafted multipart field namesGHSA-wc9g-mqfw-jrwm · 8 Sep 2026fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via file descriptor leak on aborted uploadsGHSA-qfvm-cv95-jqjf · 8 Sep 2026fixed in 2.3.0
- Highmulter vulnerable to Denial of Service via oversized array index in field namesGHSA-535w-7cp7-47q4 · 8 Sep 2026fixed in 2.3.0
- HighMulter vulnerable to Denial of Service via deeply nested field namesGHSA-72gw-mp4g-v24j · 17 Jun 2026fixed in 2.2.0
- HighMulter Vulnerable to Denial of Service via Uncontrolled RecursionGHSA-5528-5vmv-3xc2 · 5 Mar 2026fixed in 2.1.1
- HighMulter vulnerable to Denial of Service via incomplete cleanupGHSA-xf7r-hgr6-v32p · 1 Mar 2026fixed in 2.1.0
- HighMulter vulnerable to Denial of Service via resource exhaustionGHSA-v52c-386h-88mc · 1 Mar 2026fixed in 2.1.0
- HighMulter vulnerable to Denial of Service via unhandled exception from malformed requestGHSA-fjgf-rc76-4x9p · 17 Jul 2025fixed in 2.0.2
- HighMulter vulnerable to Denial of Service via unhandled exceptionGHSA-g5hg-p3ph-g8qg · 5 Jun 2025fixed in 2.0.1
- HighMulter vulnerable to Denial of Service from maliciously crafted requestsGHSA-4pg4-qvpc-4q3h · 19 May 2025
- HighMulter vulnerable to Denial of Service via memory leaks from unclosed streamsGHSA-44fp-w29j-9vj5 · 19 May 2025
- Moderatemulter vulnerable to Denial of Service via orphaned disk writes on aborted uploadsGHSA-3pph-fpjx-jg34 · 28 Sep 2026fixed in 2.4.0
- ModerateMulter vulnerable to Denial of Service via incomplete cleanup of aborted uploadsGHSA-3p4h-7m6x-2hcm · 17 Jun 2026fixed in 2.2.0
- Lowmulter vulnerable to file size limit bypass via async fileFilter race conditionGHSA-qvfw-j98x-7q72 · 8 Sep 2026fixed in 2.3.0
Registry facts last checked 4 Nov 2026. Releases and advisories last read 4 Nov 2026.