Is multer 2.2 vulnerable?
npm · 1 release from 2.2.0 to 2.2.0 · latest multer is 2.5.0 · checked 1 Nov 2026
Yes: 6 known advisories
Yes. multer 2.2.0, the last 2.2 release, is affected by 6 known security advisories (4 high, 1 medium, 1 low), including CVE-2026-113872, CVE-2026-77078, CVE-2026-77037. Upgrade to 2.5.0 or later to fix all of them.
npm install multer@2.5.0Advisories affecting multer 2.2.0
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
- Affected
- >=2.0.0 <2.5.0
- Fixed in
- 2.5.0
multer vulnerable to Denial of Service via orphaned disk writes on aborted uploads
- Affected
- >=2.2.0 <2.4.0
- Fixed in
- 2.4.0
multer vulnerable to Denial of Service via crafted multipart field names
- Affected
- <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
- Affected
- >=2.2.0 <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to file size limit bypass via async fileFilter race condition
- Affected
- <2.3.0
- Fixed in
- 2.3.0
multer vulnerable to Denial of Service via oversized array index in field names
- Affected
- <2.3.0
- Fixed in
- 2.3.0
Which of your client projects are still on multer 2.2?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact multer version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other multer versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.