{"id":"CVE-2026-77063","title":"multer: Multer: File size limit bypass via asynchronous file filter race condition (CVE-2026-77063)","summary":"A flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability a…","severity":"low","cvss":3.7,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","cvssSource":"vendor","cwe":["CWE-367","CWE-362"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["logging_subsystem_for_red_hat_openshift","3scale_api_management_platform 2","developer_hub","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","trusted_profile_analyzer","self_service_automation_portal 2"],"patched":["multer 2.3.0"],"published":"2026-08-28","updated":"2026-09-27","sourceUpdated":"2026-09-27T15:09:27+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77063.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77063.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-77063"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2525796"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-77063"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77063"},{"url":"https://cna.openjsf.org/security-advisories.html"},{"url":"https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72"},{"url":"https://github.com/expressjs/multer/commit/ab6aeae650328cf31799dcfa4c3e116ba8faaacc"},{"url":"https://github.com/expressjs/multer/releases/tag/v2.3.0"},{"url":"https://github.com/advisories/GHSA-qvfw-j98x-7q72"}],"tags":["csaf","vex","red-hat","ghsa","npm"],"epss":0.00233,"epssPercentile":0.14155,"aliases":["GHSA-qvfw-j98x-7q72"],"ecosystem":"npm","ingestedAt":"2026-09-08T22:12:30.967Z","slug":"CVE-2026-77063","body":"## Overview\n\nA flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability allows a remote attacker to bypass the intended file size restrictions, enabling the processing of files that exceed the configured limit. Although the underlying parsing mechanism still truncates the oversized file, this flaw circumvents the initial rejection of such files.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Low · affected: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Developer Hub, Red Hat Enterprise Linux 10, … · updated 2026-09-27 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77063.json)\n\n**multer: Multer: File size limit bypass via asynchronous file filter race condition** — rated Low by Red Hat. Released 2026-08-28, updated 2026-09-27.\n\nAffected:\n\n- Logging Subsystem for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Trusted Profile Analyzer\n- Self-service automation portal 2\n\nNo fix planned:\n\n- Logging Subsystem for Red Hat OpenShift\n- Red Hat 3scale API Management Platform 2\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Trusted Profile Analyzer\n- Self-service automation portal 2\n\nNot affected:\n\n- Red Hat Hardened Images\n\n## Remediation\n\nFix deferred\n\nWorkarounds / mitigations:\n\n- Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs.\n\n## Package advisory (CVE-2026-77063)\n\nAffected packages:\n\n- `multer < 2.3.0`\n\nPatched in:\n\n- `multer 2.3.0`\n\nSource: https://github.com/advisories/GHSA-qvfw-j98x-7q72","depth":"sunlit","depthScore":20,"depthScoreParts":{"impact":20.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}