multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Upgrading multer From 1.4.4 to 2.5.0
9 releases in betweenevery note read
Before you upgrade
Tick each one off as you go- breaking2.0.0
- breaking2.0.0
Security
Fixes 11 advisories affecting 1.4.4
- Multer vulnerable to Denial of Service via memory leaks from unclosed streamshigh · GHSA-44fp-w29j-9vj5
- Multer vulnerable to Denial of Service from maliciously crafted requestshigh · GHSA-4pg4-qvpc-4q3h
- multer vulnerable to Denial of Service via oversized array index in field nameshigh · GHSA-535w-7cp7-47q4
- Multer Vulnerable to Denial of Service via Uncontrolled Recursionhigh · GHSA-5528-5vmv-3xc2
- Multer vulnerable to Denial of Service via deeply nested field nameshigh · GHSA-72gw-mp4g-v24j
- Multer vulnerable to Denial of Service via unhandled exception from malformed requesthigh · GHSA-fjgf-rc76-4x9p
- Multer vulnerable to Denial of Service via unhandled exceptionhigh · GHSA-g5hg-p3ph-g8qg
- multer vulnerable to file size limit bypass via async fileFilter race conditionlow · GHSA-qvfw-j98x-7q72
- Multer vulnerable to Denial of Service via resource exhaustionhigh · GHSA-v52c-386h-88mc
- multer vulnerable to Denial of Service via crafted multipart field nameshigh · GHSA-wc9g-mqfw-jrwm
- Multer vulnerable to Denial of Service via incomplete cleanuphigh · GHSA-xf7r-hgr6-v32p
- 2.5.0
- 2.4.0
- 2.3.0
- 2.3.0
- 2.3.0
- 2.3.0
- 2.2.0
- 2.2.0
- 2.1.1
- 2.1.0
Release by release
- security
- fixed
Don't add a failed upload to the abort cleanup list
- fixed
Allow a field value exactly at the fieldSize limit
- security
- new
Add filename to file errors
- new
Accept a function for limits
- new
Expose busboy defCharset, highWaterMark and fileHwm options
- security
- security
- security
- security
- security
- security
- security
- fixed
Fix error/abort handling
- security
- security
- new
Add Turkish translation (README-tr.md)
- security
- security
- new
Add Arabic translation for README ..
- fixed
Fix a mistake with README-pt-br.md
23 other lines we could not sort, mostly version bumps
- 2.4.0
Feat. improve wording for LIMIT_UNEXPECTED_FILE error code
- 2.3.0
Update busboy link pointing to nonexistent section
- 2.3.0
Update outdated links to Express error handling guide
- 2.3.0
Update 'README-zh-cn.md' up to now
- 2.1.0
headers-support-utf8
- 2.0.1
Update README.md to fix issue #1114
- 2.0.1
Improved documentation translation to Spanish
- 2.0.1
Translated to french
- 2.0.1
Improve the Brazilian Portuguese translation
- 2.0.1
Update in Readme-pt-br and fix in Readme-ko
65 internal lines (docs, tests, tooling) left out.