Repository navigation
chore(deps): update dependency multer to v2.3.0 [security] - #1883
Merged
Merged
Conversation
|
BanManager-WebUI
 |
||||||||||||||||||||||||||||
| Project |
BanManager-WebUI
|
| Branch Review |
renovate/npm-multer-vulnerability
|
| Run status |
|
| Run duration | 02m 12s |
| Commit |
|
| Committer | renovate[bot] |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
 |
0
|
 |
0
|
 |
1
|
 |
0
|
 |
49
|
| View all changes introduced in this branch ↗︎ | |
BanManager-WebUI
|
||||||||||||||||||||||||||||
| Project |
BanManager-WebUI
|
| Branch Review |
master
|
| Run status |
|
| Run duration | 02m 18s |
| Commit |
|
| Committer | renovate[bot] |
| View all properties for this run ↗︎ | |
| Test results | |
|---|---|
|
|
0
|
|
|
0
|
|
|
1
|
|
|
0
|
|
|
49
|
| View all changes introduced in this branch ↗︎ | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.2.0→2.3.0multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
CVE-2026-77037 / GHSA-qfvm-cv95-jqjf
More information
Details
Impact
A vulnerability in multer
2.2.0allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When usingdiskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.Patches
Users should upgrade to
2.3.0.Workarounds
None.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
multer vulnerable to Denial of Service via oversized array index in field names
CVE-2026-82333 / GHSA-535w-7cp7-47q4
More information
Details
Impact
multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The
append-fielddependency parses bracket notation in field names, and a large numeric index such asitems[4294967294]forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.Patches
Users should upgrade to
2.3.0and configurelimits.fieldArrayIndexLimitto the minimum array index their application requires.Workarounds
None.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
multer vulnerable to file size limit bypass via async fileFilter race condition
CVE-2026-77063 / GHSA-qvfw-j98x-7q72
More information
Details
Impact
When
multeris configured with an asynchronousfileFilter, thelimits.fileSizelimit can be bypassed. The'limit'event is registered inside the asyncfileFiltercallback, so if a file exceedslimits.fileSizebefore that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with aLIMIT_FILE_SIZEerror. Applications that rely onlimits.fileSizeto reject oversized uploads are affected on all upload methods (.single(),.array(),.fields(),.any()). Uploads using a synchronousfileFilterare not affected.Patches
Users should upgrade to
2.3.0.Workarounds
Use a synchronous
fileFilter, or validate the uploaded file size after the upload completes.Severity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
multer vulnerable to Denial of Service via crafted multipart field names
CVE-2026-77078 / GHSA-wc9g-mqfw-jrwm
More information
Details
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single
multipart/form-datarequest. Two specially crafted text field names cause an uncaughtRangeError: Invalid array lengthinside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.Patches
Users should upgrade to
2.3.0.Workarounds
None.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
expressjs/multer (multer)
v2.3.0Compare Source
MulterErrorcodesINVALID_FIELD_NAMEandSTREAM_DESTROYEDlimits.fieldArrayIndexLimitto bound numeric array indexes in field names (#1438)limits.fileSize(#1407)AsyncLocalStorage) when callingnext()(#1124)%0A,%0D,%22) infile.originalname(#1421)fileFilterinvokes its callback more than once (#1427)MulterErrorcodes without a mapping (#1448)preservePathandparts, usecrypto.randomBytesin theDiskStorageexample (#1414, #1430, #1436)Configuration
📅 Schedule: (in timezone Europe/London)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.