Skip to main content
cve.nowby Sazabi
← npm
npmPackage

multer

15 known vulnerabilities (12 high, 2 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
2.5.0 (Oct 22, 2026): no advisory affects it
Newest unaffected release
2.5.0 (Oct 22, 2026), the latest release
Advisories
15 · 12 high, 2 medium, 1 low
Weekly downloads
31.4M
Dependents
3,484
Releases
58 since 0.0.1 (Feb 1, 2014)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 15 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 15

  • multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

    Affected: from 2.0.0, fixed in 2.5.0.

    Fixed in 2.5.0 (released Oct 22, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    51% of multer downloads last week were affected versions (17.2M).

  • CVE-2026-88932Medium 5.3

    multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads

    Affected: from 2.2.0, fixed in 2.4.0.

    Fixed in 2.4.0 (released Sep 14, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    13% of multer downloads last week were affected versions (4.4M).

  • multer vulnerable to Denial of Service via oversized array index in field names

    Affected: fixed in 2.3.0.

    Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    49% of multer downloads last week were affected versions (16.5M).

  • multer vulnerable to Denial of Service via crafted multipart field names

    Affected: fixed in 2.3.0.

    Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    49% of multer downloads last week were affected versions (16.5M).

  • multer vulnerable to file size limit bypass via async fileFilter race condition

    Affected: fixed in 2.3.0.

    Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    49% of multer downloads last week were affected versions (16.5M).

  • multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

    Affected: from 2.2.0, fixed in 2.3.0.

    Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    8.5% of multer downloads last week were affected versions (2.9M).

  • CVE-2026-5038Medium 5.3

    multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

    Affected: from 2.0.0-alpha.1, fixed in 2.2.0; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.2.

    Fixed in 2.2.0 (released Jun 15, 2026, the day of disclosure) and 3.0.0-alpha.2 (released Jun 15, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    22% of multer downloads last week were affected versions (7.6M).

  • multer vulnerable to Denial of Service via deeply nested field names

    Affected: from 1.0.0, fixed in 2.2.0; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.2.

    Fixed in 2.2.0 (released Jun 15, 2026, the day of disclosure) and 3.0.0-alpha.2 (released Jun 15, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    40% of multer downloads last week were affected versions (13.6M).

  • Multer vulnerable to Denial of Service via uncontrolled recursion

    Affected: fixed in 2.1.1.

    Fixed in 2.1.1 (released Mar 4, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    32% of multer downloads last week were affected versions (11M).

  • Multer vulnerable to Denial of Service via incomplete cleanup

    Affected: fixed in 2.1.0.

    Fixed in 2.1.0 (released Feb 27, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    32% of multer downloads last week were affected versions (10.9M).

  • Multer vulnerable to Denial of Service via resource exhaustion

    Affected: fixed in 2.1.0.

    Fixed in 2.1.0 (released Feb 27, 2026, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    32% of multer downloads last week were affected versions (10.9M).

  • Multer vulnerable to Denial of Service via unhandled exception from malformed request

    Affected: from 1.4.4-lts.1, fixed in 2.0.2.

    Fixed in 2.0.2 (released Jul 17, 2025, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    18% of multer downloads last week were affected versions (6.1M).

  • Multer vulnerable to Denial of Service via unhandled exception

    Affected: from 1.4.4-lts.1, fixed in 2.0.1.

    Fixed in 2.0.1 (released Jun 3, 2025, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    17% of multer downloads last week were affected versions (5.7M).

  • Multer vulnerable to Denial of Service from maliciously crafted requests

    Affected: from 1.4.4-lts.1, fixed in 2.0.0.

    Fixed in 2.0.0 (released May 19, 2025, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    17% of multer downloads last week were affected versions (5.7M).

  • Multer vulnerable to Denial of Service via memory leaks from unclosed streams

    Affected: fixed in 2.0.0.

    Fixed in 2.0.0 (released May 19, 2025, the day of disclosure).

    The latest release, 2.5.0, is not affected.

    18% of multer downloads last week were affected versions (6M).