multer vulnerable to file size limit bypass via async fileFilter race condition

THẤP 3.7CVE-2026-77063 · GHSA-qvfw-j98x-7q72 · Công bố 28/08/2026 · cập nhật 02/09/2026

Tóm tắt nhanh

CVE-2026-77063 là lỗ hổng mức THẤP (CVSS 3.7) ảnh hưởng multer (expressjs), multer.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.23%, cao hơn 14.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.3.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
multer expressjs	`< 2.3.0`	`2.3.0`
multer npm	`< 2.3.0`	`2.3.0`

Mô tả

Impact

When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a LIMIT_FILE_SIZE error. Applications that rely on limits.fileSize to reject oversized uploads are affected on all upload methods (.single(), .array(), .fields(), .any()). Uploads using a synchronous fileFilter are not affected.

Patches

Users should upgrade to 2.3.0.

Workarounds

Use a synchronous fileFilter, or validate the uploaded file size after the upload completes.

Mô tả của NVD

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.