[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
multer	2.4.0 → 2.5.0

---

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

CVE-2026-113872 / GHSA-q7qp-rjg7-q26m

More information

Details

Impact

When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is enough, so any application using multer with an asynchronous fileFilter is affected, regardless of storage engine. Uploads using a synchronous fileFilter are not affected.

Patches

Users should upgrade to multer 2.5.0 or later.

Workarounds

Use a synchronous fileFilter.

Severity

• CVSS Score: 7.5 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

• https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m
• https://nvd.nist.gov/vuln/detail/CVE-2026-113872
• https://github.com/expressjs/multer/commit/80a2d9df1dfd63b5fab631b8b9966164ed647adf
• https://cna.openjsf.org/security-advisories.html
• https://github.com/expressjs/multer/releases/tag/v2.5.0
• https://github.com/advisories/GHSA-q7qp-rjg7-q26m

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

expressjs/multer (multer)

v2.5.0

Compare Source

• Fix CVE-2026-113872 (GHSA-q7qp-rjg7-q26m)
• Accept a field value of exactly limits.fieldSize bytes, so LIMIT_FIELD_VALUE fires only when the limit is exceeded. This also covers the default fieldSize of 1MB, so a 1048576 byte value is no longer rejected when you set no limits. If you set fieldSize one higher to work around this, you can drop the extra one (#​1481)
• Do not add a file to the abort cleanup list when its storage engine reports an error after a LIMIT_FILE_SIZE abort; DiskStorage no longer tries to unlink an undefined path (#​1489)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9fc3b048-3377-4c9f-a1a9-3bcf7e52299c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}