Multer vulnerabilities
We track 6 vulnerabilities in Multer products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 22, 2026.
Latest Multer vulnerabilities
- 7.5 High severity
multer: Uncaught Exception
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while on
- 7.5 High severity
multer: Uncontrolled Resource Consumption
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the process
- 7.5 High severity
multer: Uncaught Exception
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a
- 7.5 High severity
multer: Uncontrolled Resource Consumption
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying wr
- 7.5 High severity
multer: Incomplete Cleanup
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files on disk because the Readable.pipe() call does not propagate
- 7.5 High severity
multer: Uncontrolled Resource Consumption
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowin