Vendor
HackerOne
20 known vulnerabilities in products by HackerOne, 0 of them actively exploited (CISA KEV).
Key figures
20
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-3520 | Multer vulnerable to Denial of Service via uncontrolled recursion | 7.5 | |
| High | CVE-2026-2359 | Multer vulnerable to Denial of Service via resource exhaustion | 7.5 | |
| High | CVE-2026-3304 | Multer vulnerable to Denial of Service via incomplete cleanup | 7.5 | |
| High | CVE-2026-77078 | multer vulnerable to Denial of Service via crafted multipart field names | 7.5 | |
| High | CVE-2026-77037 | multer vulnerable to Denial of Service via file descriptor leak on aborted uploads | 7.5 | |
| High | CVE-2017-16136 | HackerOne method-override node module: Uncontrolled Resource Consumption | 7.5 | |
| High | CVE-2025-7338 | Multer vulnerable to Denial of Service via unhandled exception from malformed request | 7.5 | |
| High | CVE-2025-47944 | Multer vulnerable to Denial of Service from maliciously crafted requests | 7.5 | |
| High | CVE-2025-47935 | Multer vulnerable to Denial of Service via memory leaks from unclosed streams | 7.5 | |
| High | CVE-2024-45590 | body-parser vulnerable to denial of service when url encoding is enabled | 7.5 | |
| High | CVE-2026-82333 | multer vulnerable to Denial of Service via oversized array index in field names | 7.5 | |
| High | CVE-2025-48997 | Multer vulnerable to Denial of Service via unhandled exception | — | |
| High | CVE-2024-47178 | basic-auth-connect's callback uses time unsafe string comparison | 5.3 | |
| Medium | CVE-2024-29041 | Express.js Open Redirect in malformed URLs | 6.1 | |
| High | CVE-2026-5079 | multer vulnerable to Denial of Service via deeply nested field names | 7.5 | |
| High | CVE-2026-5038 | multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads | 5.3 | |
| Medium | CVE-2024-43800 | serve-static affected by template injection that can lead to XSS | 5.0 | |
| Medium | CVE-2024-43796 | express vulnerable to XSS via response.redirect() | 5.0 | |
| Low | CVE-2026-77063 | multer vulnerable to file size limit bypass via async fileFilter race condition | 3.7 | |
| Medium | CVE-2024-9266 | Open Redirect | 4.7 |
Products
| ExpressJS Multer | 13 | 0 |
| Express | 3 | 0 |