Thinkerhao

**Name of the Vulnerable Software and Affected Versions** multer versions prior to 2.3.0 **Description** A race condition exists in the file stream handling when an application utilizes an asynchronous `fileFilter` in conjunction with the `fileSize` limit. This allows files that exceed the configured size limit to bypass the limit rejection. The impact is limited as the underlying multipart parser still truncates the stream at the size limit, meaning the issue is a bypass of the rejection mechanism rather than uncontrolled resource consumption. **Recommendations** Update to version 2.3.0.