expressjs multer vulnerabilities

Latest expressjs multer CVEs

Newest publication first

1. CVE-2026-82333 multer vulnerable to Denial of Service via oversized array index in field names

   Published 2026-08-28

   High·CVSS 7.5 EPSS 0.37%

   multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process cannot handle other...

2. CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names

   Published 2026-08-28

   High·CVSS 7.5 EPSS 0.49%

   multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a very large numeric a...

3. CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition

   Published 2026-08-28

   Low·CVSS 3.7 EPSS 0.20%

   multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-l...

4. CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

   Published 2026-08-28

   High·CVSS 7.5 EPSS 0.46%

   multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying write file descriptor,...

5. CVE-2026-5038 multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

   Published 2026-06-15

   High·CVSS 7.5 EPSS 0.37%

   Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate the stream destroy s...

6. CVE-2026-5079 multer vulnerable to Denial of Service via deeply nested field names

   Published 2026-06-15

   High·CVSS 7.5 EPSS 0.28%

   Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to for...

7. CVE-2026-3520 Multer vulnerable to Denial of Service via uncontrolled recursion

   Published 2026-03-04

   High·CVSS 8.7 EPSS 0.82%

   Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to re...

8. CVE-2026-3304 Multer vulnerable to Denial of Service via incomplete cleanup

   Published 2026-02-27

   High·CVSS 8.7 EPSS 0.74%

   Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0...

9. CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion

   Published 2026-02-27

   High·CVSS 8.7 EPSS 0.74%

   Multer is a node.js middleware for handling multipart/form-data. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to ve...

10. CVE-2025-7338 Multer vulnerable to Denial of Service via unhandled exception from malformed request

    Published 2025-07-17

    High·CVSS 7.5 EPSS 0.81%

    Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request cause...

11. CVE-2025-48997 Multer vulnerable to Denial of Service via unhandled exception

    Published 2025-06-03

    High·CVSS 8.7 EPSS 0.48%

    Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. T...

12. CVE-2025-47944 Multer vulnerable to Denial of Service from maliciously crafted requests

    Published 2025-05-19

    High·CVSS 7.5 EPSS 0.81%

    Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request cause...

13. CVE-2025-47935 Multer vulnerable to Denial of Service via memory leaks from unclosed streams

    Published 2025-05-19

    High·CVSS 7.5 EPSS 0.80%

    Multer is a node.js middleware for handling multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal busboy stream is not closed, violating...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.