# Expressjs vulnerabilities Source: https://junglewise.ai/threats/vendors/expressjs Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/expressjs.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 11 vulnerabilities in Expressjs: 0 in the last 7 days and 4 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-113872, was published on 22 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 4 - All time: 11 (0 critical, 0 exploited in the wild) ## Latest Expressjs vulnerabilities - [CVE-2026-113872: multer denial of service in asynchronous fileFilter after request teardown](https://junglewise.ai/threats/cve-2026-113872-multer-is-a-middleware-for-node-js-that-handles-multipart-form) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-87859: morgan HTTP request logger log injection via unescaped double quote](https://junglewise.ai/threats/cve-2026-87859-morgan-http-request-logger-log-injection-via-unescaped-double) (medium, CVSS 5.3, published 11 Sep 2026) - [CVE-2026-82333: multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-77063: multer file size limit bypass via async fileFilter race condition](https://junglewise.ai/threats/cve-2026-77063-multer-file-size-limit-bypass-via-async-filefilter-race-condition) (low, CVSS 3.7, published 28 Aug 2026) - [CVE-2026-12590: OpenJS body-parser denial of service via invalid limit configuration](https://junglewise.ai/threats/cve-2026-12590-openjs-body-parser-denial-of-service-via-invalid-limit) (low, CVSS 3.7, published 9 Jul 2026) - [CVE-2026-5038: Multer Denial of Service via incomplete cleanup in diskStorage](https://junglewise.ai/threats/cve-2026-5038-multer-denial-of-service-via-incomplete-cleanup-in-diskstorage) (medium, CVSS 5.3, published 15 Jun 2026) - [CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names](https://junglewise.ai/threats/cve-2026-5079-openjs-multer-denial-of-service-via-deeply-nested-field-names) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-5078: OpenJS morgan log forgery via unneutralized :remote-user token](https://junglewise.ai/threats/cve-2026-5078-openjs-morgan-log-forgery-via-unneutralized-remote-user-token) (medium, CVSS 5.3, published 3 Jun 2026) - [CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup](https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-2359: expressjs multer denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-2359-expressjs-multer-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2025-47944: Multer denial of service from malformed multipart requests](https://junglewise.ai/threats/cve-2025-47944-multer-denial-of-service-from-malformed-multipart-requests) (low, CVSS 3.1, published 19 May 2025) ## Most severe Expressjs vulnerabilities - [CVE-2026-3304: expressjs Multer denial of service via incomplete cleanup](https://junglewise.ai/threats/cve-2026-3304-expressjs-multer-denial-of-service-via-incomplete-cleanup) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-2359: expressjs multer denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-2359-expressjs-multer-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 27 Feb 2026) - [CVE-2026-82333: multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names) (high, CVSS 7.5, published 28 Aug 2026) - [CVE-2026-5079: OpenJS Multer Denial of Service via deeply nested field names](https://junglewise.ai/threats/cve-2026-5079-openjs-multer-denial-of-service-via-deeply-nested-field-names) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-113872: multer denial of service in asynchronous fileFilter after request teardown](https://junglewise.ai/threats/cve-2026-113872-multer-is-a-middleware-for-node-js-that-handles-multipart-form) (high, CVSS 7.5, published 22 Oct 2026) - [CVE-2026-5038: Multer Denial of Service via incomplete cleanup in diskStorage](https://junglewise.ai/threats/cve-2026-5038-multer-denial-of-service-via-incomplete-cleanup-in-diskstorage) (medium, CVSS 5.3, published 15 Jun 2026) - [CVE-2026-5078: OpenJS morgan log forgery via unneutralized :remote-user token](https://junglewise.ai/threats/cve-2026-5078-openjs-morgan-log-forgery-via-unneutralized-remote-user-token) (medium, CVSS 5.3, published 3 Jun 2026) - [CVE-2026-87859: morgan HTTP request logger log injection via unescaped double quote](https://junglewise.ai/threats/cve-2026-87859-morgan-http-request-logger-log-injection-via-unescaped-double) (medium, CVSS 5.3, published 11 Sep 2026) - [CVE-2026-12590: OpenJS body-parser denial of service via invalid limit configuration](https://junglewise.ai/threats/cve-2026-12590-openjs-body-parser-denial-of-service-via-invalid-limit) (low, CVSS 3.7, published 9 Jul 2026) - [CVE-2026-77063: multer file size limit bypass via async fileFilter race condition](https://junglewise.ai/threats/cve-2026-77063-multer-file-size-limit-bypass-via-async-filefilter-race-condition) (low, CVSS 3.7, published 28 Aug 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 2 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 1 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 1 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Expressjs vulnerabilities", https://junglewise.ai/threats/vendors/expressjs, 9 November 2026.