Cloudanix VulnDB

CVE-2026-77063

Low · 3.7

CVSS

3.7

EPSS

0.2%

Published

Aug 28, 2026

CISA due date

—

The record

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities