CVE-2026-77063Low· 3.7▾ Sunlitmulter vulnerable to file size limit bypass via async fileFilter race condition
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a LIMIT_FILE_SIZE error. Applications that rely on limits.fileSize to reject oversized uploads are affected on all upload methods (.single(), .array(), .fields(), .any()). Uploads using a synchronous fileFilter are not affected.
Users should upgrade to 2.3.0.
Use a synchronous fileFilter, or validate the uploaded file size after the upload completes.
multer < 2.3.0Upgrade to a patched release:
multer 2.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-77037High· 7.5multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
CVE-2026-77078High· 7.5multer vulnerable to Denial of Service via crafted multipart field names
CVE-2026-82333High· 7.5multer vulnerable to Denial of Service via oversized array index in field names
CVE-2026-43631High· 8.1llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary…
CVE-2023-35823High· 7.0An issue was discovered in the Linux kernel before 6.3.2
CVE-2026-20617High· 7.0A race condition was addressed with improved state handling