CVE-2026-77063: multer Package File Size Limit Bypass Vulnerability
Summary
CVE-2026-77063: multer vulnerable to file size limit bypass via async fileFilter race condition. Affects multer versions < 2.3.0. Fixed in 2.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
multer is a popular middleware for handling multipart/form-data, primarily used for uploading files in Node.js applications. It provides a simple API for file uploads and supports various configurations, including file size limits to prevent oversized uploads. However, a vulnerability has been identified that allows attackers to bypass these file size limits under certain conditions.
Vulnerability Detail
The vulnerability arises when multer is configured with an asynchronous fileFilter. In this scenario, the limits.fileSize can be bypassed if a file exceeds the specified limit before the async fileFilter callback is executed. This results in the 'limit' event being missed, allowing oversized files to be accepted without triggering a LIMIT_FILE_SIZE error. This issue affects all upload methods, including .single(), .array(), .fields(), and .any(). Synchronous fileFilters are not impacted by this vulnerability.
How To Fix
Latest published version: 2.5.0 as of 23 Oct 2026
npm install multer@2.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.3.0
This is the first release that contains the fix.
npm install multer@2.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can use a synchronous fileFilter instead of an asynchronous one. Alternatively, you can validate the uploaded file size after the upload completes to ensure it does not exceed the specified limits. Here is an example of a synchronous fileFilter:
const multer = require('multer');
const upload = multer({
limits: { fileSize: 1000000 }, // 1 MB limit
fileFilter: (req, file, cb) => {
if (file.size > 1000000) {
return cb(new Error('File size exceeds limit'), false);
}
cb(null, true);
}
});
Conclusion
The CVE-2026-77063 vulnerability in the multer package allows for file size limit bypass through an asynchronous fileFilter. Users are advised to upgrade to version 2.3.0 or implement workarounds to mitigate the risk. Regular monitoring for vulnerabilities is essential to maintain application security.
See every vulnerability recorded for multer →
FAQ
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
All versions of multer prior to 2.3.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unaddressed, this vulnerability could allow attackers to upload oversized files, potentially leading to denial of service or other security issues.
Yes, Vulert can monitor your project for open-source vulnerabilities in real-time using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for multer.
