Race Condition in Multer Middleware for Node.js by Express.js

CVE-2026-77063

What is CVE-2026-77063?

Multer, a middleware for handling multipart/form-data in Node.js, has a race condition that can occur when using an asynchronous fileFilter alongside a fileSize limit. This issue allows files exceeding the size limit to bypass rejection mechanisms. Although the multipart parser truncates streams at the configured size, the vulnerability represents a potential security risk, as it enables a bypass of the size restriction. This flaw affects all versions of multer prior to 2.3.0. Users are advised to upgrade to multer version 2.3.0 or higher to mitigate this risk.

References