---
title: "multer security advisories"
description: "15 known security advisories for multer, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/multer/security
lang: en
---

[Packages](https://inlinr.com/packages)

# multer

2.5.0 · 22 Oct 2026 MIT 30.7M / week [Repository](https://github.com/expressjs/multer) [Homepage](https://github.com/expressjs/multer#readme) [npm](https://www.npmjs.com/package/multer) [Atom feed](https://inlinr.com/packages/feed/multer)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                            |
| ---- | ------ | -------------------------------------------------------------------------- |
|      | 2.5.0  | Safe from 2.5.0                                                            |
|      | 1.4.4  | 25 open advisories, worst high  · last release Dec 2021, no longer updated |

- High  
[multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown](https://inlinr.com/advisories/GHSA-q7qp-rjg7-q26m)GHSA-q7qp-rjg7-q26m · 23 Oct 2026  
fixed in 2.5.0
- High  
[multer vulnerable to Denial of Service via crafted multipart field names](https://inlinr.com/advisories/GHSA-wc9g-mqfw-jrwm)GHSA-wc9g-mqfw-jrwm · 8 Sep 2026  
fixed in 2.3.0
- High  
[multer vulnerable to Denial of Service via file descriptor leak on aborted uploads](https://inlinr.com/advisories/GHSA-qfvm-cv95-jqjf)GHSA-qfvm-cv95-jqjf · 8 Sep 2026  
fixed in 2.3.0
- High  
[multer vulnerable to Denial of Service via oversized array index in field names](https://inlinr.com/advisories/GHSA-535w-7cp7-47q4)GHSA-535w-7cp7-47q4 · 8 Sep 2026  
fixed in 2.3.0
- High  
[Multer vulnerable to Denial of Service via deeply nested field names](https://inlinr.com/advisories/GHSA-72gw-mp4g-v24j)GHSA-72gw-mp4g-v24j · 17 Jun 2026  
fixed in 2.2.0
- High  
[Multer Vulnerable to Denial of Service via Uncontrolled Recursion](https://inlinr.com/advisories/GHSA-5528-5vmv-3xc2)GHSA-5528-5vmv-3xc2 · 5 Mar 2026  
fixed in 2.1.1
- High  
[Multer vulnerable to Denial of Service via incomplete cleanup](https://inlinr.com/advisories/GHSA-xf7r-hgr6-v32p)GHSA-xf7r-hgr6-v32p · 1 Mar 2026  
fixed in 2.1.0
- High  
[Multer vulnerable to Denial of Service via resource exhaustion](https://inlinr.com/advisories/GHSA-v52c-386h-88mc)GHSA-v52c-386h-88mc · 1 Mar 2026  
fixed in 2.1.0
- High  
[Multer vulnerable to Denial of Service via unhandled exception from malformed request](https://inlinr.com/advisories/GHSA-fjgf-rc76-4x9p)GHSA-fjgf-rc76-4x9p · 17 Jul 2025  
fixed in 2.0.2
- High  
[Multer vulnerable to Denial of Service via unhandled exception](https://inlinr.com/advisories/GHSA-g5hg-p3ph-g8qg)GHSA-g5hg-p3ph-g8qg · 5 Jun 2025  
fixed in 2.0.1
- High  
[Multer vulnerable to Denial of Service from maliciously crafted requests](https://inlinr.com/advisories/GHSA-4pg4-qvpc-4q3h)GHSA-4pg4-qvpc-4q3h · 19 May 2025
- High  
[Multer vulnerable to Denial of Service via memory leaks from unclosed streams](https://inlinr.com/advisories/GHSA-44fp-w29j-9vj5)GHSA-44fp-w29j-9vj5 · 19 May 2025
- Moderate  
[multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads](https://inlinr.com/advisories/GHSA-3pph-fpjx-jg34)GHSA-3pph-fpjx-jg34 · 28 Sep 2026  
fixed in 2.4.0
- Moderate  
[Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads](https://inlinr.com/advisories/GHSA-3p4h-7m6x-2hcm)GHSA-3p4h-7m6x-2hcm · 17 Jun 2026  
fixed in 2.2.0
- Low  
[multer vulnerable to file size limit bypass via async fileFilter race condition](https://inlinr.com/advisories/GHSA-qvfw-j98x-7q72)GHSA-qvfw-j98x-7q72 · 8 Sep 2026  
fixed in 2.3.0

### Quality and security signals

What [npm](https://www.npmjs.com/package/multer) and [deps.dev](https://deps.dev/npm/multer) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.