Express: fix available. Version unknown.
Last 30 days
2No criticalFix available
Safe versions
No fixed version published.
Alerts(2)
Sorted by severityExploitable only if · read by Claude, the source remains the reference
- Project uses multer below version 2.5.0.
- multer is configured with an asynchronous fileFilter.
- The multer upload endpoint accepts requests from untrusted (including unauthenticated) clients.
- Affected
- multer >=2.0.0 <2.5.0
- Fixed in
- 2.5.0
- ID
- GHSA-q7qp-rjg7-q26m
Conditions not read yet
Source summary
Impact Multer's diskStorage can leave complete, orphaned files on disk when a multipart upload is aborted in the brief window before the storage engine assigns the file path. This is an incomplete fix of CVE-2026-5038: the earlier cleanup removes only in-flight uploads that already have a path, so an upload aborted inside that window is written to disk with nothing left to remove it, and the application is not given a handle to clean it up. An unauthenticated attacker sending aborted requests to any route backed by disk storage can accumulate orphaned files until the upload directory or the sh
- Affected
- multer >=2.2.0 <2.4.0
- Fixed in
- 2.4.0
- ID
- GHSA-3pph-fpjx-jg34
Follow Express
All readgithub.com/expressjs/express/security16:48 UTCgithub.com/expressjs/multer/security16:48 UTCexpressjs.com/feed.xml16:48 UTCGitHub advisory database16:48 UTC
/feeds/stacks/express.json