multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Upgrading multer From 0.1.7 to 2.3.0
25 releases in betweennotes for 24
Counted from 24 of 25 release notes. Advisories are counted from the advisory database, in full.
Before you upgrade
Tick each one off as you go- breaking2.0.0
- breaking2.0.0
Security
2 advisories still affect 2.3.0
- multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsmoderate · GHSA-3pph-fpjx-jg34
- multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownhigh · GHSA-q7qp-rjg7-q26m
Upgrading to 2.5.0 clears them.
Fixes 7 advisories affecting 0.1.7
- Multer vulnerable to Denial of Service via memory leaks from unclosed streamshigh · GHSA-44fp-w29j-9vj5
- multer vulnerable to Denial of Service via oversized array index in field nameshigh · GHSA-535w-7cp7-47q4
- Multer Vulnerable to Denial of Service via Uncontrolled Recursionhigh · GHSA-5528-5vmv-3xc2
- multer vulnerable to file size limit bypass via async fileFilter race conditionlow · GHSA-qvfw-j98x-7q72
- Multer vulnerable to Denial of Service via resource exhaustionhigh · GHSA-v52c-386h-88mc
- multer vulnerable to Denial of Service via crafted multipart field nameshigh · GHSA-wc9g-mqfw-jrwm
- Multer vulnerable to Denial of Service via incomplete cleanuphigh · GHSA-xf7r-hgr6-v32p
- 2.3.0
- 2.3.0
- 2.3.0
- 2.3.0
- 2.2.0
- 2.2.0
- 2.1.1
- 2.1.0
- 2.1.0
- 2.0.2
Release by release
- security
- security
- security
- security
- security
- security
- security
- fixed
Fix error/abort handling
- security
- security
- new
Add Turkish translation (README-tr.md)
- security
- security
- new
Add Arabic translation for README ..
- fixed
Fix a mistake with README-pt-br.md
- security
- security
- breaking
The minimum supported Node version is now 10.16.0
- breaking
🐛 drain stream. fixes regression in node 18, remove old CI, set minimum node version, fix readme badges, add .npmrc
- fixed
Handle two busboy error events
- fixed
Bugfix: Handle missing field names
- fixed
30 other lines we could not sort, mostly version bumps
- 2.3.0
Update busboy link pointing to nonexistent section
- 2.3.0
Update outdated links to Express error handling guide
- 2.3.0
Update 'README-zh-cn.md' up to now
- 2.1.0
headers-support-utf8
- 2.0.1
Update README.md to fix issue #1114
- 2.0.1
Improved documentation translation to Spanish
- 2.0.1
Translated to french
- 2.0.1
Improve the Brazilian Portuguese translation
- 2.0.1
Update in Readme-pt-br and fix in Readme-ko
- 2.0.1
Documentation: Remove unfortunate abbreviation from readme
69 internal lines (docs, tests, tooling) left out.