multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Upgrading multer From 1.4.4 to 2.0.0
1 release in betweenevery note read
Before you upgrade
Tick each one off as you go- breaking2.0.0
- breaking2.0.0
Security
11 advisories still affect 2.0.0
- Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploadsmoderate · GHSA-3p4h-7m6x-2hcm
- multer vulnerable to Denial of Service via oversized array index in field nameshigh · GHSA-535w-7cp7-47q4
- Multer Vulnerable to Denial of Service via Uncontrolled Recursionhigh · GHSA-5528-5vmv-3xc2
Upgrading to 2.5.0 clears them.
Fixes 2 advisories affecting 1.4.4
- Multer vulnerable to Denial of Service via memory leaks from unclosed streamshigh · GHSA-44fp-w29j-9vj5
- Multer vulnerable to Denial of Service from maliciously crafted requestshigh · GHSA-4pg4-qvpc-4q3h
- 2.0.0
- 2.0.0
Release by release
- security
- security
- breaking
The minimum supported Node version is now 10.16.0
- breaking
🐛 drain stream. fixes regression in node 18, remove old CI, set minimum node version, fix readme badges, add .npmrc
- fixed
Handle two busboy error events
4 other lines we could not sort, mostly version bumps
- 2.0.0
♻️ fully drain stream
- 2.0.0
🥅 explicitly handle req error
- 2.0.0
🚨 lint:fix
- 2.0.0
⬆️ bump mocha
1 internal line (docs, tests, tooling) left out.