multer
2.5.0 · 22 Oct 2026MIT30.7M / weekRepositoryHomepagenpmAtom feed
Upgrading multer From 2.2.0 to 2.3.0
1 release in betweenevery note read
Other targets from 2.2.0Newest 2.x, Clears its 6 advisories, Latest2.5.0
- 0
- changes to make
- 4
- advisories fixed
- 2
- new
- 5
- fixes
Security
2 advisories still affect 2.3.0
- multer vulnerable to Denial of Service via orphaned disk writes on aborted uploadsmoderate · GHSA-3pph-fpjx-jg34
- multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownhigh · GHSA-q7qp-rjg7-q26m
Upgrading to 2.5.0 clears them.
Fixes 4 advisories affecting 2.2.0
- multer vulnerable to Denial of Service via oversized array index in field nameshigh · GHSA-535w-7cp7-47q4
- multer vulnerable to Denial of Service via file descriptor leak on aborted uploadshigh · GHSA-qfvm-cv95-jqjf
- multer vulnerable to file size limit bypass via async fileFilter race conditionlow · GHSA-qvfw-j98x-7q72
- multer vulnerable to Denial of Service via crafted multipart field nameshigh · GHSA-wc9g-mqfw-jrwm
- 2.3.0
- 2.3.0
- 2.3.0
- 2.3.0
Release by release
- security
- security
- security
- security
3 other lines we could not sort, mostly version bumps
- 2.3.0
Update busboy link pointing to nonexistent section
- 2.3.0
Update outdated links to Express error handling guide
- 2.3.0
Update 'README-zh-cn.md' up to now
19 internal lines (docs, tests, tooling) left out.