GCVE - cpe:2.3:a:expressjs:multer:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:expressjs:multer:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Expressjs (`519b9279-76a0-583a-9169-17f58a48d658`)
Product	Multer (`8c0e8773-6720-5358-8033-97c149a0aa13`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/expressjs/multer`	purl2cpe	2026-06-01 10:11:20.429746
`pkg:npm/multer`	purl2cpe	2026-06-01 10:11:20.429750

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-3520`	vulnerable	2026-06-08 08:01:18.911599	Multer vulnerable to Denial of Service via uncontrolled recursion Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow. Users should upgrade to version 2.1.1 to receive a patch. No known workarounds are available. Published: 2026-03-04T16:17:18.962Z Updated: 2026-07-15T01:03:04.430Z Open on db.gcve.eu Reference links https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2 https://www.cve.org/CVERecord?id=CVE-2026-3520 https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752 https://cna.openjsf.org/security-advisories.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-3304`	vulnerable	2026-06-08 08:01:18.362308	Multer vulnerable to Denial of Service via incomplete cleanup Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available. Published: 2026-02-27T15:44:37.187Z Updated: 2026-07-15T01:07:21.678Z Open on db.gcve.eu Reference links https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p https://www.cve.org/CVERecord?id=CVE-2026-3304 https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee https://cna.openjsf.org/security-advisories.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-2359`	vulnerable	2026-06-08 07:55:16.954091	Multer vulnerable to Denial of Service via resource exhaustion Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available. Published: 2026-02-27T15:42:08.088Z Updated: 2026-07-15T01:18:16.179Z Open on db.gcve.eu Reference links https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc https://www.cve.org/CVERecord?id=CVE-2026-2359 https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab https://cna.openjsf.org/security-advisories.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-7338`	vulnerable	2026-06-08 07:43:18.349524	Multer vulnerable to Denial of Service via unhandled exception from malformed request HIGH (7.5) Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available. Published: 2025-07-17T15:26:45.427Z Updated: 2025-07-17T16:48:43.154Z Open on db.gcve.eu Reference links https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b https://cna.openjsf.org/security-advisories.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-48997`	vulnerable	2026-06-08 07:29:12.439921	Multer vulnerable to Denial of Service via unhandled exception Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available. Published: 2025-06-03T18:21:59.527Z Updated: 2025-06-03T18:30:13.178Z Open on db.gcve.eu Reference links https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg https://github.com/expressjs/multer/issues/1233 https://github.com/expressjs/multer/pull/1256 https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-47944`	vulnerable	2026-06-08 07:27:15.097099	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-47935`	vulnerable	2026-06-08 07:27:15.090191	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.