multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Upgrading multer From 1.0.3 to 1.4.4
13 releases in betweenevery note read
Security
11 advisories still affect 1.4.4
- Multer vulnerable to Denial of Service via memory leaks from unclosed streamshigh · GHSA-44fp-w29j-9vj5
- Multer vulnerable to Denial of Service from maliciously crafted requestshigh · GHSA-4pg4-qvpc-4q3h
- multer vulnerable to Denial of Service via oversized array index in field nameshigh · GHSA-535w-7cp7-47q4
Upgrading to 2.3.0 clears them.
Release by release
- fixed
Bugfix: Handle missing field names
- fixed
- fixed
Bugfix: Avoid deprecated pseudoRandomBytes function
- fixed
1.4.1 – 1.4.22 releases, nothing new or fixed in the notes
- new
Make Multer errors inherit from MulterError
- new
1.3.1nothing new or fixed in the note
- new
Expose preservePath option
- new
- fixed
Bugfix: Prevent Multiple Errors from Crashing
- fixed
- new
Add .none() for accepting only fields
- new
5 other lines we could not sort, mostly version bumps
- 1.4.1
Bugfix: Make sure that req.file.buffer always is a Buffer
- 1.3.1
Bugfix: Bump vulnerable dependency
- 1.0.6
Bugfix: Always report limit errors
- 1.0.5
Bugfix: Drain the stream before considering request done
- 1.0.4
Bugfix: Propagate all errors from busboy
19 internal lines (docs, tests, tooling) left out.