---
id: CVE-2026-77063
title: >-
  multer: Multer: File size limit bypass via asynchronous file filter race
  condition (CVE-2026-77063)
summary: >-
  A flaw was found in multer, a software component used in Node.js applications
  to handle file uploads. When an application configures an asynchronous file
  filter along with a file size limit, a race condition can occur. This
  vulnerability a…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: vendor
cwe:
  - CWE-367
  - CWE-362
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - logging_subsystem_for_red_hat_openshift
  - 3scale_api_management_platform 2
  - developer_hub
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - trusted_profile_analyzer
  - self_service_automation_portal 2
patched:
  - multer 2.3.0
published: '2026-08-28'
updated: '2026-09-27'
sourceUpdated: '2026-09-27T15:09:27+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77063.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77063.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-77063'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2525796'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-77063'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-77063'
  - url: 'https://cna.openjsf.org/security-advisories.html'
  - url: >-
      https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72
  - url: >-
      https://github.com/expressjs/multer/commit/ab6aeae650328cf31799dcfa4c3e116ba8faaacc
  - url: 'https://github.com/expressjs/multer/releases/tag/v2.3.0'
  - url: 'https://github.com/advisories/GHSA-qvfw-j98x-7q72'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - npm
epss: 0.00233
epssPercentile: 0.14155
aliases:
  - GHSA-qvfw-j98x-7q72
ecosystem: npm
ingestedAt: '2026-09-08T22:12:30.967Z'
---

## Overview

A flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability allows a remote attacker to bypass the intended file size restrictions, enabling the processing of files that exceed the configured limit. Although the underlying parsing mechanism still truncates the oversized file, this flaw circumvents the initial rejection of such files.

## Vendor advisories

- **Red Hat VEX** · Low · affected: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Developer Hub, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, … · no fix planned: Logging Subsystem for Red Hat OpenShift, Red Hat 3scale API Management Platform 2, Red Hat Developer Hub, Red Hat Enterprise Linux 10, … · updated 2026-09-27 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77063.json)

**multer: Multer: File size limit bypass via asynchronous file filter race condition** — rated Low by Red Hat. Released 2026-08-28, updated 2026-09-27.

Affected:

- Logging Subsystem for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Trusted Profile Analyzer
- Self-service automation portal 2

No fix planned:

- Logging Subsystem for Red Hat OpenShift
- Red Hat 3scale API Management Platform 2
- Red Hat Developer Hub
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Trusted Profile Analyzer
- Self-service automation portal 2

Not affected:

- Red Hat Hardened Images

## Remediation

Fix deferred

Workarounds / mitigations:

- Upgrade to multer 2.3.0 or later. For CVE-2026-82333, multer 2.3.0 adds an opt-in fieldArrayIndexLimit option that rejects oversized array indexes - set limits.fieldArrayIndexLimit to the largest array index your application needs.

## Package advisory (CVE-2026-77063)

Affected packages:

- `multer < 2.3.0`

Patched in:

- `multer 2.3.0`

Source: https://github.com/advisories/GHSA-qvfw-j98x-7q72