Is multer 2.1 vulnerable?
npm · 2 releases from 2.1.0 to 2.1.1 · latest multer is 2.5.0 · checked 2 Nov 2026
Yes: 6 known advisories
Yes. multer 2.1.1, the last 2.1 release, is affected by 6 known security advisories (4 high, 1 medium, 1 low), including CVE-2026-113872, CVE-2026-77078, CVE-2026-82333. 1 more affects earlier 2.1.x releases. Upgrade to 2.5.0 or later to fix all of them.
npm install multer@2.5.0Advisories affecting multer 2.1.1
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
- Affected
- >=2.0.0 <2.5.0
- Fixed in
- 2.5.0
multer vulnerable to Denial of Service via crafted multipart field names
- Affected
- <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to file size limit bypass via async fileFilter race condition
- Affected
- <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to Denial of Service via oversized array index in field names
- Affected
- <2.3.0
- Fixed in
- 2.3.0
Multer vulnerable to Denial of Service via deeply nested field names
- Affected
- >=1.0.0 <2.2.0 · >=3.0.0-alpha.1 <3.0.0-alpha.2
- Fixed in
- 2.2.0, 3.0.0-alpha.2
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
- Affected
- >=2.0.0-alpha.1 <2.2.0 · >=3.0.0-alpha.1 <3.0.0-alpha.2
- Fixed in
- 2.2.0, 3.0.0-alpha.2
Fixed within 2.1.x, affecting earlier releases
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
- Affected
- <2.1.1
- Fixed in
- 2.1.1
Which of your client projects are still on multer 2.1?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact multer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other multer versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.