CVE-2026-77063

Analyzed Analyzed - Analysis Complete

Race Condition in Multer File Size Limit Bypass

Publication date: 2026-08-28

Last updated on: 2026-09-02

Assigner: openjs

Description

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-08-29

EPSS Evaluated

2026-09-15

NVD

CVE-2026-77063

Affected Vendors & Products

Vendor	Product	Version / Range
expressjs	multer	to 2.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the multer library, which handles file uploads in Node.js. When an application uses an asynchronous file filter with a file size limit, the race condition can allow files exceeding the size limit to bypass the rejection mechanism. This happens during file stream handling in multer versions before 2.3.0.

Detection Guidance

Detecting this vulnerability requires checking the version of multer in use. Run 'npm list multer' in your project directory to see the installed version. If the version is below 2.3.0, the system is vulnerable.

Impact Analysis

The impact is limited because the underlying multipart parser still enforces the size limit by truncating the stream. However, this vulnerability allows the size limit rejection to be bypassed, meaning files that should be rejected for exceeding size limits may still be processed.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized file uploads that exceed size limits. If an application processes sensitive data (e.g., personal or health information), bypassing size limits might violate data protection requirements for secure handling and storage.

Mitigation Strategies

Upgrade multer to version 2.3.0 or later using 'npm install multer@2.3.0'. Review file upload handlers to ensure fileSize limits are properly enforced and fileFilter functions are synchronous where possible.

Hi! I’m here to help you understand CVE-2026-77063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70