Product by HackerOne
ExpressJS Multer
13 known vulnerabilities in ExpressJS Multer (HackerOne), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-3520 | Multer vulnerable to Denial of Service via uncontrolled recursion | 7.5 | |
| High | CVE-2026-2359 | Multer vulnerable to Denial of Service via resource exhaustion | 7.5 | |
| High | CVE-2026-3304 | Multer vulnerable to Denial of Service via incomplete cleanup | 7.5 | |
| High | CVE-2026-77078 | multer vulnerable to Denial of Service via crafted multipart field names | 7.5 | |
| High | CVE-2026-77037 | multer vulnerable to Denial of Service via file descriptor leak on aborted uploads | 7.5 | |
| High | CVE-2025-7338 | Multer vulnerable to Denial of Service via unhandled exception from malformed request | 7.5 | |
| High | CVE-2025-47944 | Multer vulnerable to Denial of Service from maliciously crafted requests | 7.5 | |
| High | CVE-2025-47935 | Multer vulnerable to Denial of Service via memory leaks from unclosed streams | 7.5 | |
| High | CVE-2026-82333 | multer vulnerable to Denial of Service via oversized array index in field names | 7.5 | |
| High | CVE-2025-48997 | Multer vulnerable to Denial of Service via unhandled exception | — | |
| High | CVE-2026-5079 | multer vulnerable to Denial of Service via deeply nested field names | 7.5 | |
| High | CVE-2026-5038 | multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads | 5.3 | |
| Low | CVE-2026-77063 | multer vulnerable to file size limit bypass via async fileFilter race condition | 3.7 |