# multer (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/npm-multer Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/npm-multer.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 15 vulnerabilities in multer (npm): 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113872, was published on 22 October 2026. 1 vulnerability in the last four weeks, level on the four before (1). ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 6 - All time: 15 (0 critical, 0 exploited in the wild) ## About multer (npm) Node.js middleware for handling multipart/form-data file uploads. ## Latest multer (npm) vulnerabilities - [CVE-2026-113872: multer denial of service in asynchronous fileFilter after request teardown](https://junglewise.ai/threats/cve-2026-113872-multer-is-a-middleware-for-node-js-that-handles-multipart-form) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-88932: Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-82333: multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77078: multer Denial of Service via crafted multipart field names](https://junglewise.ai/threats/cve-2026-77078-multer-denial-of-service-via-crafted-multipart-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77063: multer file size limit bypass via async fileFilter race condition](https://junglewise.ai/threats/cve-2026-77063-multer-file-size-limit-bypass-via-async-filefilter-race-condition) (low, CVSS 3.7, published 28 Aug 2026) - [CVE-2026-77037: Express multer file descriptor leak on aborted uploads](https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-5038: Multer Denial of Service via incomplete cleanup in diskStorage](https://junglewise.ai/threats/cve-2026-5038-multer-denial-of-service-via-incomplete-cleanup-in-diskstorage) (medium, CVSS 5.3, published 15 Jun 2026) - [CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names](https://junglewise.ai/threats/cve-2026-5079-openjs-multer-denial-of-service-via-deeply-nested-field-names) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-3520: expressjs Multer denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-3520-expressjs-multer-denial-of-service-via-uncontrolled-recursion) (high, CVSS 7.5, published 4 Mar 2026) - [CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup](https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-2359: expressjs multer denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-2359-expressjs-multer-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2025-7338: Multer denial of service via unhandled exception](https://junglewise.ai/threats/cve-2025-7338-multer-denial-of-service-via-unhandled-exception) (low, CVSS 3.1, published 17 Jul 2025) - [CVE-2025-48997: Multer Denial of Service via unhandled exception](https://junglewise.ai/threats/cve-2025-48997-multer-denial-of-service-via-unhandled-exception) (medium, CVSS 4, published 5 Jun 2025) - [CVE-2025-47944: Multer denial of service from malformed multipart requests](https://junglewise.ai/threats/cve-2025-47944-multer-denial-of-service-from-malformed-multipart-requests) (low, CVSS 3.1, published 19 May 2025) - [CVE-2025-47935: Multer memory leak denial of service via unclosed streams](https://junglewise.ai/threats/cve-2025-47935-multer-memory-leak-denial-of-service-via-unclosed-streams) (low, CVSS 3.1, published 19 May 2025) ## Most severe multer (npm) vulnerabilities - [CVE-2026-3520: expressjs Multer denial of service via uncontrolled recursion](https://junglewise.ai/threats/cve-2026-3520-expressjs-multer-denial-of-service-via-uncontrolled-recursion) (high, CVSS 7.5, published 4 Mar 2026) - [CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup](https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-2359: expressjs multer denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-2359-expressjs-multer-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-77037: Express multer file descriptor leak on aborted uploads](https://junglewise.ai/threats/cve-2026-77037-express-multer-file-descriptor-leak-on-aborted-uploads) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-82333: multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77078: multer Denial of Service via crafted multipart field names](https://junglewise.ai/threats/cve-2026-77078-multer-denial-of-service-via-crafted-multipart-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names](https://junglewise.ai/threats/cve-2026-5079-openjs-multer-denial-of-service-via-deeply-nested-field-names) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-113872: multer denial of service in asynchronous fileFilter after request teardown](https://junglewise.ai/threats/cve-2026-113872-multer-is-a-middleware-for-node-js-that-handles-multipart-form) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-88932: Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2026-5038: Multer Denial of Service via incomplete cleanup in diskStorage](https://junglewise.ai/threats/cve-2026-5038-multer-denial-of-service-via-incomplete-cleanup-in-diskstorage) (medium, CVSS 5.3, published 15 Jun 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, level on the four before (1). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 4 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "multer (npm) vulnerabilities", https://junglewise.ai/threats/technologies/npm-multer, 13 November 2026.