# multer (npm) vulnerabilities 15 known vulnerabilities (12 high, 2 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.5.0 (Oct 22, 2026): no advisory affects it - Newest unaffected release: 2.5.0 (Oct 22, 2026), the latest release - Weekly downloads: 31.4M - Dependents: 3,484 - Releases: 58 since 0.0.1 (Feb 1, 2014) - Registry: https://www.npmjs.com/package/multer - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-113872: 2.0.0 to 2.4.0 (2.5.0 is outside it) - CVE-2026-88932: 2.2.0 to 2.3.0 (2.4.0 is outside it) - CVE-2026-82333: 0.0.1 to 2.2.0 (2.3.0 is outside it) - CVE-2026-77078: 0.0.1 to 2.2.0 (2.3.0 is outside it) - CVE-2026-77063: 0.0.1 to 2.2.0 (2.3.0 is outside it) - CVE-2026-77037: 2.2.0 (2.3.0 is outside it) - CVE-2026-5038: 2.0.0-alpha.1 to 2.1.1 (2.2.0 is outside it); 3.0.0-alpha.1 (3.0.0-alpha.2 is outside it) - CVE-2026-5079: 1.0.0 to 2.1.1 (2.2.0 is outside it); 3.0.0-alpha.1 (3.0.0-alpha.2 is outside it) - CVE-2026-3520: 0.0.1 to 2.1.0 (2.1.1 is outside it) - CVE-2026-3304: 0.0.1 to 2.0.2 (2.1.0 is outside it) - CVE-2026-2359: 0.0.1 to 2.0.2 (2.1.0 is outside it) - CVE-2025-7338: 1.4.4-lts.1 to 2.0.1 (2.0.2 is outside it) - CVE-2025-48997: 1.4.4-lts.1 to 2.0.0 (2.0.1 is outside it) - CVE-2025-47944: 1.4.4-lts.1 to 2.0.0-rc.4 (2.0.0 is outside it) - CVE-2025-47935: 0.0.1 to 2.0.0-rc.4 (2.0.0 is outside it) ## Advisories (15) ### [CVE-2026-113872](https://cve.now/CVE-2026-113872): multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown - Severity: High 7.5 - Published: Oct 22, 2026 - Affected: from 2.0.0, fixed in 2.5.0. - Fixed in 2.5.0 (released Oct 22, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 51% of multer downloads last week were affected versions (17.2M). ### [CVE-2026-88932](https://cve.now/CVE-2026-88932): multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads - Severity: Medium 5.3 - Published: Sep 14, 2026 - Affected: from 2.2.0, fixed in 2.4.0. - Fixed in 2.4.0 (released Sep 14, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 13% of multer downloads last week were affected versions (4.4M). ### [CVE-2026-82333](https://cve.now/CVE-2026-82333): multer vulnerable to Denial of Service via oversized array index in field names - Severity: High 7.5 - Published: Aug 28, 2026 - Affected: fixed in 2.3.0. - Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 49% of multer downloads last week were affected versions (16.5M). ### [CVE-2026-77078](https://cve.now/CVE-2026-77078): multer vulnerable to Denial of Service via crafted multipart field names - Severity: High 7.5 - Published: Aug 28, 2026 - Affected: fixed in 2.3.0. - Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 49% of multer downloads last week were affected versions (16.5M). ### [CVE-2026-77063](https://cve.now/CVE-2026-77063): multer vulnerable to file size limit bypass via async fileFilter race condition - Severity: Low 3.7 - Published: Aug 28, 2026 - Affected: fixed in 2.3.0. - Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 49% of multer downloads last week were affected versions (16.5M). ### [CVE-2026-77037](https://cve.now/CVE-2026-77037): multer vulnerable to Denial of Service via file descriptor leak on aborted uploads - Severity: High 7.5 - Published: Aug 28, 2026 - Affected: from 2.2.0, fixed in 2.3.0. - Fixed in 2.3.0 (released Aug 28, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 8.5% of multer downloads last week were affected versions (2.9M). ### [CVE-2026-5038](https://cve.now/CVE-2026-5038): multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads - Severity: Medium 5.3 - Published: Jun 15, 2026 - Affected: from 2.0.0-alpha.1, fixed in 2.2.0; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.2. - Fixed in 2.2.0 (released Jun 15, 2026, the day of disclosure) and 3.0.0-alpha.2 (released Jun 15, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 22% of multer downloads last week were affected versions (7.6M). ### [CVE-2026-5079](https://cve.now/CVE-2026-5079): multer vulnerable to Denial of Service via deeply nested field names - Severity: High 7.5 - Published: Jun 15, 2026 - Affected: from 1.0.0, fixed in 2.2.0; from 3.0.0-alpha.1, fixed in 3.0.0-alpha.2. - Fixed in 2.2.0 (released Jun 15, 2026, the day of disclosure) and 3.0.0-alpha.2 (released Jun 15, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 40% of multer downloads last week were affected versions (13.6M). ### [CVE-2026-3520](https://cve.now/CVE-2026-3520): Multer vulnerable to Denial of Service via uncontrolled recursion - Severity: High 8.7 - Published: Mar 4, 2026 - Affected: fixed in 2.1.1. - Fixed in 2.1.1 (released Mar 4, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 32% of multer downloads last week were affected versions (11M). ### [CVE-2026-3304](https://cve.now/CVE-2026-3304): Multer vulnerable to Denial of Service via incomplete cleanup - Severity: High 8.7 - Published: Feb 27, 2026 - Affected: fixed in 2.1.0. - Fixed in 2.1.0 (released Feb 27, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 32% of multer downloads last week were affected versions (10.9M). ### [CVE-2026-2359](https://cve.now/CVE-2026-2359): Multer vulnerable to Denial of Service via resource exhaustion - Severity: High 8.7 - Published: Feb 27, 2026 - Affected: fixed in 2.1.0. - Fixed in 2.1.0 (released Feb 27, 2026, the day of disclosure). - The latest release, 2.5.0, is not affected. - 32% of multer downloads last week were affected versions (10.9M). ### [CVE-2025-7338](https://cve.now/CVE-2025-7338): Multer vulnerable to Denial of Service via unhandled exception from malformed request - Severity: High 7.5 - Published: Jul 17, 2025 - Affected: from 1.4.4-lts.1, fixed in 2.0.2. - Fixed in 2.0.2 (released Jul 17, 2025, the day of disclosure). - The latest release, 2.5.0, is not affected. - 18% of multer downloads last week were affected versions (6.1M). ### [CVE-2025-48997](https://cve.now/CVE-2025-48997): Multer vulnerable to Denial of Service via unhandled exception - Severity: High 8.7 - Published: Jun 3, 2025 - Affected: from 1.4.4-lts.1, fixed in 2.0.1. - Fixed in 2.0.1 (released Jun 3, 2025, the day of disclosure). - The latest release, 2.5.0, is not affected. - 17% of multer downloads last week were affected versions (5.7M). ### [CVE-2025-47944](https://cve.now/CVE-2025-47944): Multer vulnerable to Denial of Service from maliciously crafted requests - Severity: High 7.5 - Published: May 19, 2025 - Affected: from 1.4.4-lts.1, fixed in 2.0.0. - Fixed in 2.0.0 (released May 19, 2025, the day of disclosure). - The latest release, 2.5.0, is not affected. - 17% of multer downloads last week were affected versions (5.7M). ### [CVE-2025-47935](https://cve.now/CVE-2025-47935): Multer vulnerable to Denial of Service via memory leaks from unclosed streams - Severity: High 7.5 - Published: May 19, 2025 - Affected: fixed in 2.0.0. - Fixed in 2.0.0 (released May 19, 2025, the day of disclosure). - The latest release, 2.5.0, is not affected. - 18% of multer downloads last week were affected versions (6M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/multer Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.