{"id":"CVE-2026-77063","aliases":["CLSA-2026-1788988502","CLSA-2026-1790176219","CLSA-2026-1791371658","DEBIAN-CVE-2026-77063","EUVD-2026-67929","GHSA-qvfw-j98x-7q72","ROOT-APP-NPM-CVE-2026-77063"],"status":"published","title":"multer vulnerable to file size limit bypass via async fileFilter race condition","description":"multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.002,"percentile":0.09969,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2026-08-28T19:54:58Z","modified":"2026-11-04T09:15:04Z","fixes":[{"ecosystem":"npm","package":"multer","fixed_in":["2.3.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"node-multer","fixed_in":["2.4.0+~cs3.2.0-1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"multer","fixed_in":["2.3.0-aikido.1","2.3.0-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/multer","fixed_in":["2.3.0-root.io.1","2.3.0-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.5-lts.2-tuxcare.0"},{"fixed":"1.4.5-lts.2-tuxcare.5"}]}],"versions":["1.4.5-lts.2","1.4.5-lts.2-tuxcare.1","1.4.5-lts.2-tuxcare.2","1.4.5-lts.2-tuxcare.3","1.4.5-lts.2-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.4.5-lts.1-tuxcare.0"},{"fixed":"1.4.5-lts.1-tuxcare.9"}]}],"versions":["1.4.5-lts.1","1.4.5-lts.1-tuxcare.1","1.4.5-lts.1-tuxcare.2","1.4.5-lts.1-tuxcare.3","1.4.5-lts.1-tuxcare.4","1.4.5-lts.1-tuxcare.5","1.4.5-lts.1-tuxcare.6","1.4.5-lts.1-tuxcare.7","1.4.5-lts.1-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0-tuxcare.0"},{"fixed":"2.2.0-tuxcare.3"}]}],"versions":["2.2.0","2.2.0-tuxcare.1","2.2.0-tuxcare.2"],"bundled":2},{"source":"osv","ecosystem":"Debian:14","package":"node-multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+~cs3.2.0-1"}]}],"versions":["2.2.0+~cs3.1.0-1","2.2.0+~cs3.1.0-2","2.2.0+~cs3.2.0-1"]},{"source":"osv","ecosystem":"npm","package":"multer","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.3.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-aikido.1"},{"fixed":"2.3.0-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/multer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-root.io.1"},{"fixed":"2.3.0-root.io.2"}]}]}],"products":[{"vendor":"expressjs","product":"multer"},{"vendor":"multer","product":"multer"}],"references":[{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72","tags":["Vendor Advisory","Mitigation","advisory","web"]},{"url":"https://cna.openjsf.org/security-advisories.html","tags":["Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77063","tags":["advisory"]},{"url":"https://github.com/expressjs/multer/commit/ab6aeae650328cf31799dcfa4c3e116ba8faaacc","tags":["web"]},{"url":"https://github.com/expressjs/multer/releases/tag/v2.3.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qvfw-j98x-7q72"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77063.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-77063","tags":["advisory"]},{"url":"https://github.com/expressjs/multer","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-77063","title":"multer vulnerable to file size limit bypass via async fileFilter race condition","description":"multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T19:54:58.473Z","modified":"2026-08-31T18:40:55.632Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:20:15.712761Z"}],"euvd":[{"id":"EUVD-2026-67929","description":"multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T19:54:58Z","modified":"2026-08-31T18:40:55Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T18:01:20.215322Z"}],"ghsa":[{"id":"GHSA-qvfw-j98x-7q72","title":"multer vulnerable to file size limit bypass via async fileFilter race condition","description":"### Impact\n\nWhen `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed. The `'limit'` event is registered inside the async `fileFilter` callback, so if a file exceeds `limits.fileSize` before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a `LIMIT_FILE_SIZE` error. Applications that rely on `limits.fileSize` to reject oversized uploads are affected on all upload methods (`.single()`, `.array()`, `.fields()`, `.any()`). Uploads using a synchronous `fileFilter` are not affected.\n\n### Patches\n\nUsers should upgrade to `2.3.0`.\n\n### Workarounds\n\nUse a synchronous `fileFilter`, or validate the uploaded file size after the upload completes.","status":"published","published":"2026-09-08T21:29:42Z","modified":"2026-09-08T21:29:43Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:41:14.764963Z"}],"nvd":[{"id":"CVE-2026-77063","description":"multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T22:16:53.76Z","modified":"2026-09-02T14:46:51.367Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:12:42.366888Z"}],"osv":[{"id":"CVE-2026-77063","title":"multer vulnerable to file size limit bypass via async fileFilter race condition","description":"multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T19:54:58.473Z","modified":"2026-10-28T02:30:47.248265501Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-77063","description":"multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.","status":"published","published":"2026-08-28T22:16:53.76Z","modified":"2026-11-02T18:00:46.444669973Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T19:03:20.122208Z"},{"id":"GHSA-qvfw-j98x-7q72","title":"multer vulnerable to file size limit bypass via async fileFilter race condition","description":"### Impact\n\nWhen `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed. The `'limit'` event is registered inside the async `fileFilter` callback, so if a file exceeds `limits.fileSize` before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a `LIMIT_FILE_SIZE` error. Applications that rely on `limits.fileSize` to reject oversized uploads are affected on all upload methods (`.single()`, `.array()`, `.fields()`, `.any()`). Uploads using a synchronous `fileFilter` are not affected.\n\n### Patches\n\nUsers should upgrade to `2.3.0`.\n\n### Workarounds\n\nUse a synchronous `fileFilter`, or validate the uploaded file size after the upload completes.","status":"published","published":"2026-09-08T21:29:42Z","modified":"2026-09-08T21:45:04.622654725Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"CLSA-2026-1788988502","title":"TuxCare security update for multer (2 CVEs)","description":"TuxCare rebuilt multer to address 2 CVEs. Fixed in 1.4.5-lts.2-tuxcare.5.","status":"published","published":"2026-09-09T21:15:02Z","modified":"2026-10-15T09:47:55.712869518Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"CLSA-2026-1790176219","title":"TuxCare security update for multer (2 CVEs)","description":"TuxCare rebuilt multer to address 2 CVEs. Fixed in 1.4.5-lts.1-tuxcare.9.","status":"published","published":"2026-09-23T15:10:19Z","modified":"2026-10-15T09:47:56.494183839Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"CLSA-2026-1791371658","title":"TuxCare security update for multer (2 CVEs)","description":"TuxCare rebuilt multer to address 2 CVEs. Fixed in 2.2.0-tuxcare.3.","status":"published","published":"2026-10-07T11:14:18Z","modified":"2026-10-15T09:47:39.590494028Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"ROOT-APP-NPM-CVE-2026-77063","title":"CVE-2026-77063 in multer - Patched by Root","description":"Root has patched CVE-2026-77063 in the multer package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-04T08:05:48Z","modified":"2026-11-04T09:15:04.234290501Z","updated_at":"2026-11-04T09:34:03.871859Z"}]}}