CVE-2026-77063

Name of the Vulnerable Software and Affected Versions multer versions prior to 2.3.0

Description A race condition exists in the file stream handling when an application utilizes an asynchronous fileFilter in conjunction with the fileSize limit. This allows files that exceed the configured size limit to bypass the limit rejection. The impact is limited as the underlying multipart parser still truncates the stream at the size limit, meaning the issue is a bypass of the rejection mechanism rather than uncontrolled resource consumption.

Recommendations Update to version 2.3.0.