CVE-2026-77063 in multer
Summary
by MITRE • 08/29/2026
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2026
The vulnerability identified within the Multer middleware for Node.js applications represents a race condition inherent in the handling of asynchronous file filters when combined with size limit configurations. Multer is widely utilized as an intermediary layer that processes multipart/form-data requests, facilitating the upload and storage of files submitted via HTTP forms. The core technical flaw emerges specifically during the execution flow where an application implements a custom file filter function that operates asynchronously. In this scenario, the middleware attempts to enforce both content validation through the asynchronous filter and resource constraints defined by the fileSize limit parameter simultaneously. Due to the non-deterministic nature of asynchronous operations in Node.js event loop, there exists a window where the stream processing logic does not correctly synchronize the termination signal from the size limiter with the completion callback of the file filter. This desynchronization allows a request containing a payload that exceeds the configured maximum byte count to bypass the intended rejection mechanism. Consequently, the application proceeds as if the validation passed successfully, even though the underlying data volume violates the security policy defined by the developer.
The operational impact of this vulnerability is nuanced and distinct from typical resource exhaustion attacks often associated with file upload flaws. While an attacker can technically submit a file larger than the specified limit, the actual damage potential is mitigated by the behavior of the underlying multipart parser used within Multer. This parser enforces hard limits on stream consumption regardless of the application-level logic errors in the middleware layer. Therefore, while the request bypasses the rejection callback and may trigger subsequent processing steps that assume a valid file size, the data stream itself is truncated at the configured boundary before it can be fully consumed or written to disk beyond that point. This means the vulnerability constitutes a logical bypass of access control checks rather than an uncontrolled resource consumption vector. However, this distinction does not render the issue harmless; applications relying on accurate file size metrics for downstream business logic, such as billing calculations, storage quota management, or integrity verification mechanisms, may behave incorrectly if they assume the uploaded file matches the expected dimensions based on a successful validation callback.
From a classification perspective, this flaw aligns with CWE-367, which describes Time-of-check to time-of-use (TOCTOU) race conditions. The application checks the validity of the file through an asynchronous filter and then uses that result while the stream state is still being modified or evaluated by other concurrent processes involving size limits. Furthermore, this vulnerability can be mapped to MITRE ATT&CK techniques related to evasion, specifically those focusing on bypassing security controls during input validation phases. Attackers could leverage this race condition in scenarios where strict file size enforcement is a prerequisite for further processing steps that might otherwise reject oversized payloads or trigger alerts. By exploiting the timing discrepancy between the asynchronous filter resolution and the stream truncation logic, an adversary can force the application to process data it was explicitly configured to reject, potentially leading to inconsistent state management within the server environment.
The remediation strategy is straightforward and relies on updating the dependency version of the Multer package. All versions prior to 2.3.0 are susceptible to this race condition due to their handling of asynchronous callbacks in conjunction with stream limits. The issue has been resolved in version 2.3.0, which implements stricter synchronization mechanisms to ensure that size limit enforcement and file filter validation occur atomically or in a properly sequenced manner that prevents the bypass window. Organizations utilizing Node.js applications with Multer for file uploads must immediately audit their dependency trees and upgrade to version 2.3.0 or later. Additionally, developers should review any custom asynchronous file filters to ensure they do not rely on assumptions about stream state that might be affected by concurrent limit enforcement logic. Implementing defense-in-depth measures, such as validating file sizes at the web server level before reaching the application framework and enforcing strict size limits in storage backend configurations, can provide additional layers of protection against similar logical flaws in future updates or alternative middleware implementations.