Vulnerability · Published Aug 28, 2026 · Assigned by openjs
CVE-2026-77063multer vulnerable to file size limit bypass via async fileFilter race condition
Low 3.7
In plain English
A low-severity race condition in multer from multer. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | node-multer | 2.4.0+~cs3.2.0-1 | DEBIAN-CVE-2026-77063 |
| npm | multer | 2.3.0 | GHSA-qvfw-j98x-7q72 |
Affected products (as reported)
Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N