Vulnerability Description
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Expressjs | Multer | < 2.3.0 |
Related Weaknesses (CWE)
References
- https://cna.openjsf.org/security-advisories.htmlVendor Advisory
- https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72Vendor AdvisoryMitigation
FAQ
What is CVE-2026-77063?
CVE-2026-77063 is a vulnerability with a CVSS score of 3.7 (LOW). multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handl...
How severe is CVE-2026-77063?
CVE-2026-77063 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-77063?
Check the references section above for vendor advisories and patch information. Affected products include: Expressjs Multer.