multer vulnerabilities
Middleware for handling `multipart/form-data`.
- Registry
- npm
- Latest
- 2.5.0
- License
- MIT
14 known advisories
The latest version, 2.5.0, is not affected by any of them. Projects on older versions may be.
npm install multer@2.5.0Security advisories for multer
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
- Affected
- >=2.2.0 <2.4.0
- Fixed in
- 2.4.0
multer vulnerable to Denial of Service via crafted multipart field names
- Affected
- <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
- Affected
- >=2.2.0 <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to file size limit bypass via async fileFilter race condition
- Affected
- <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to Denial of Service via oversized array index in field names
- Affected
- <2.3.0
- Fixed in
- 2.3.0
Multer vulnerable to Denial of Service via deeply nested field names
- Affected
- >=1.0.0 <2.2.0 · >=3.0.0-alpha.1 <3.0.0-alpha.2
- Fixed in
- 2.2.0, 3.0.0-alpha.2
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
- Affected
- >=2.0.0-alpha.1 <2.2.0 · >=3.0.0-alpha.1 <3.0.0-alpha.2
- Fixed in
- 2.2.0, 3.0.0-alpha.2
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
- Affected
- <2.1.1
- Fixed in
- 2.1.1
Multer vulnerable to Denial of Service via incomplete cleanup
- Affected
- <2.1.0
- Fixed in
- 2.1.0
Multer vulnerable to Denial of Service via resource exhaustion
- Affected
- <2.1.0
- Fixed in
- 2.1.0
Multer vulnerable to Denial of Service via unhandled exception from malformed request
- Affected
- >=1.4.4-lts.1 <2.0.2
- Fixed in
- 2.0.2
Multer vulnerable to Denial of Service via unhandled exception
- Affected
- >=1.4.4-lts.1 <2.0.1
- Fixed in
- 2.0.1
Multer vulnerable to Denial of Service from maliciously crafted requests
- Affected
- >=1.4.4-lts.1 <2.0.0
- Fixed in
- 2.0.0
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
- Affected
- <2.0.0
- Fixed in
- 2.0.0
Which of your client projects still run an old multer?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.