Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package multer, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.
CVEs (9)
CVE-2025-48997: Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and…
CVE-2025-47944 — CVSS 7.5 (high): Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and…
CVE-2025-7338 — CVSS 7.5 (high): Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and…
CVE-2026-2359 — CVSS 7.5 (high): Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to…
CVE-2026-3304 — CVSS 7.5 (high): Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to…
CVE-2026-3520 — CVSS 7.5 (high): Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.1 allows an attacker to…
CVE-2026-5079 — CVSS 7.5 (high): Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in…
CVE-2025-47935 — CVSS 7.5 (high): Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and…
CVE-2026-5038 — CVSS 5.3 (medium): Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted…