multer has 2 advisories. Version not read yet.
npm ↗Versions
Red: affected by at least one advisory. White: safe. The dot is the version in your lockfile.
Details
- You run
- not in lockfile
- Safe
- 2.5.0 · 2.4.0
- Advisories
- 2 in 120 days
Alerts(2)
- Project uses multer below version 2.5.0.
- multer is configured with an asynchronous fileFilter.
- The multer upload endpoint accepts requests from untrusted (including unauthenticated) clients.
- Affected
- multer >=2.0.0 <2.5.0
- Fixed in
- 2.5.0
- ID
- GHSA-q7qp-rjg7-q26m
Source summary
Impact Multer's diskStorage can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the sh
- Affected
- multer >=2.2.0 <2.4.0
- Fixed in
- 2.4.0
- ID
- GHSA-3pph-fpjx-jg34