CVE-2026-77063Low· 3.7▾ SunlitA flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
0.2% → 0.2%
Last analysed / modified upstream
A flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability allows a remote attacker to bypass the intended file size restrictions, enabling the processing of files that exceed the configured limit. Although the underlying parsing mechanism still truncates the oversized file, this flaw circumvents the initial rejection of such files.
multer: Multer: File size limit bypass via asynchronous file filter race condition — rated Low by Red Hat. Released 2026-08-28, updated 2026-09-27.
Affected:
No fix planned:
Not affected:
Fix deferred
Workarounds / mitigations:
Affected packages:
multer < 2.3.0Patched in:
multer 2.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77037High· 7.5multer: Multer: Denial of Service via file descriptor leak on aborted uploads (CVE-2026-77037)
CVE-2026-68338High· 7.0kernel: net/packet: avoid fanout hook re-registration after unregister (CVE-2026-68338)
CVE-2026-89603High· 7.8Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-52945High· 7.5In the Linux kernel, the following vulnerability has been resolved: Revert "wireguard: device: enable threaded NAPI" This reverts commit 933466fc50a8e4eb167acbd0d8ec96a078462e9c which is commit db9ae3b6b43c79b1ba87eea849fd65efa05b4b2e …
CVE-2026-106071Low· 3.6nodejs: nodejs: Permission model bypass via wildcard path matching flaw (CVE-2026-106071)
CVE-2026-106070Low· 3.7nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch (CVE-2026-106070)