CVE-2026-77063 multer vulnerable to file size limit bypass via async fileFilter race condition

What is CVE-2026-77063?

CVE-2026-77063 is a low-severity vulnerability in multer, published on 28 Aug 2026.

Official description

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Weakness: CWE-362

Which versions are affected by CVE-2026-77063?

2 open source packages ship an affected version, including multer. It affects 1 product.

Products include Expressjs Multer.

How do I fix CVE-2026-77063?

Upgrade multer to 2.3.0 or later.

Is CVE-2026-77063 being exploited?

There is no known exploitation of CVE-2026-77063 in the wild and no public exploit code.

Other vulnerabilities in multer

• CVE-2026-3520 Multer vulnerable to Denial of Service via uncontrolled recursion High 8.7
• CVE-2026-2359 Multer vulnerable to Denial of Service via resource exhaustion High 8.7
• CVE-2026-3304 Multer vulnerable to Denial of Service via incomplete cleanup High 8.7
• CVE-2026-77037 multer vulnerable to Denial of Service via file descriptor leak on aborted uploads High 7.5
• CVE-2026-77078 multer vulnerable to Denial of Service via crafted multipart field names High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-VJ23809, ECHO-bfbe-94c6-77e4, GHSA-qvfw-j98x-7q72, MINI-5vr7-rrcj-32vh, MINI-ffvp-cj38-6g5j, MINI-q8vv-78mf-f2pf and 1 more.