Description

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-28T22:16:53.760Z",
  "pubdate": "2026-08-28T22:16:53.760Z",
  "executiveSummary": "A race condition vulnerability exists in the multer middleware for Node.js, specifically affecting the interaction between asynchronous fileFilter functions and configured fileSize limits.\nThe vulnerability allows an attacker to bypass file size restriction logic, potentially leading to the processing of files that exceed defined constraints.\nAffected versions include all iterations prior to 2.3.0.\nWhile the underlying multipart parser continues to truncate the file stream at the limit—preventing arbitrary uncontrolled resource consumption (DoS)—the application logic fails to properly trigger the rejection mechanism.\nThis creates a discrepancy where the application may perceive an oversized file as valid or fail to handle the rejection event as expected, potentially leading to logic errors or improper file handling within downstream processing pipelines.\nSuccessful exploitation requires the application to utilize an asynchronous fileFilter in conjunction with size-limited multipart uploads.\nRemediation is achieved by updating the multer dependency to version 2.3.0 or later.",
  "technicalDetails": "The vulnerability originates from a race condition within the multer middleware when handling multipart/form-data streams. Specifically, the issue manifests when the middleware is configured with a fileSize limit and employs an asynchronous fileFilter callback to determine whether a file should be accepted for processing.\nIn the vulnerable implementation, the file stream management logic fails to synchronize correctly between the asynchronous filter evaluation and the stream truncation signal emitted by the multipart parser. When an incoming request initiates an upload that exceeds the defined fileSize, the fileFilter execution is intended to halt the process. However, due to the race condition, the asynchronous nature of the filter allows the internal state tracking of the file stream to reach an inconsistent state.\nThe attack flow proceeds as follows: An attacker sends a multipart/form-data request containing a file that exceeds the established fileSize limit. As the chunks arrive, the multipart parser correctly identifies the size violation and triggers a truncation event. Simultaneously, the application's asynchronous fileFilter is invoked. Because of the race condition, the logic responsible for confirming the rejection is bypassed or delayed, causing the middleware to proceed as if the file is within acceptable bounds, or failing to propagate the rejection error to the application layer. Consequently, the stream processing continues despite the violation of security policy.\nThe component responsible for this behavior is the core stream handling logic within multer that coordinates the interaction between the parser's limit checks and user-defined filter logic. Because the multipart parser still enforces truncation, the impact is strictly limited to a bypass of the rejection handling logic rather than a failure to cap the data stream; the server does not suffer from uncontrolled resource consumption or unbounded memory/disk usage as a result of this specific flaw.\nThe vulnerability affects all versions of multer prior to 2.3.0. There are no specific authentication or privilege requirements to trigger the vulnerability, as it is inherent to the middleware's stream processing mechanics during multipart handling. Network exposure is dependent on the application's implementation of multer; any endpoint accepting multipart/form-data with file filters and size limits is potentially susceptible to this bypass."
}