CVE-2026-77063
Last modified
CVE-2026-77063 is a low-severity vulnerability rated 3.7/10 on the CVSS scale. multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection.
Description
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.
Metrics
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| multer | multer | < 2.3.0 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-77063?
How severe is CVE-2026-77063?
How do I fix CVE-2026-77063?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-77035Joomla Extension - joomlaeventmanager.net - Cross-user event…5.1
- CVE-2026-77036A vulnerability was found in elunez eladmin up to 2.7. The i…6.3
- CVE-2026-77037multer is a middleware for handling multipart/form-data in N…7.5
- CVE-2026-7704A vulnerability has been found in AV Stumpfl Pixera Two Medi…4.3
- CVE-2026-7705A flaw has been found in JD Cloud JDCOS 4.5.1.r4518. This vu…6.3
- CVE-2026-7706A vulnerability has been found in Open5GS up to 2.7.7. This …4.3
- CVE-2026-77066The scanFeedsResolver in packages/api/src/resolvers/subscrip…5
- CVE-2026-77067The setWebhookResolver in packages/api/src/resolvers/webhook…5
- CVE-2026-77068n8n before 2.33.4 and 2.34.x before 2.34.1 contain a remote …8.7
- CVE-2026-77069n8n before 1.123.69, 2.33.4, and 2.34.1 contains an SSRF pro…2.3
- CVE-2026-7707A vulnerability was found in Open5GS up to 2.7.7. Impacted i…4.3
- CVE-2026-77070n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL inj…7.1
Are you affected by CVE-2026-77063?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST