CVE-2026-77063 Overview
CVE-2026-77063 is a race condition [CWE-362] in multer, a widely used Node.js middleware for handling multipart/form-data. When an application configures an asynchronous fileFilter alongside the fileSize limit, a timing flaw in the file stream handling can allow files larger than the configured limit to bypass the size-limit rejection. All versions of multer before 2.3.0 are affected. The multipart parser still truncates the stream at the size boundary, so this issue is a bypass of the rejection logic rather than uncontrolled resource consumption. The maintainers fixed the issue in multer2.3.0.
Critical Impact
Applications relying on multer's fileSize limit for validation may accept oversized uploads under specific asynchronous fileFilter configurations, weakening integrity controls on upload endpoints.
Affected Products
- expressjs/multer all versions prior to 2.3.0
- Node.js applications using multer with asynchronous fileFilter and fileSize limits
- Express.js services that expose multipart/form-data upload endpoints via multer
Discovery Timeline
- 2026-08-28 - CVE-2026-77063 published to the National Vulnerability Database (NVD)
- 2026-09-02 - Last updated in NVD database
Technical Details for CVE-2026-77063
Vulnerability Analysis
The vulnerability stems from a race condition between the asynchronous fileFilter callback and multer's internal stream size enforcement. When fileFilter is defined as an async function, control returns to the event loop before the filter decision resolves. During that window, the file stream continues to receive bytes. When the fileSize limit is reached, multer should reject the upload, but the ordering of the async filter result and the size-limit signal can cause the rejection path to be skipped for the accepted file. The parser still truncates the underlying stream at the configured byte limit, which caps memory and disk consumption. The functional impact is limited to integrity: the application receives a file that should have been rejected outright rather than delivered as truncated content.
Root Cause
The root cause is non-deterministic ordering between two asynchronous events in multer's upload pipeline. The async fileFilter promise resolution and the limits.fileSize boundary signal are not synchronized. As a result, an application-level check that should block oversized files can race past the limit-exceeded state.
Attack Vector
An unauthenticated network attacker submits a multipart/form-data request containing a file larger than the server's configured fileSize limit. The request targets an endpoint that combines an asynchronous fileFilter with size limits. Because attack complexity is high, exploitation requires specific timing conditions to trigger the race. Confidentiality and availability are not affected; the impact is limited to integrity of upload validation.
No public proof-of-concept or exploit code is available. See the GitHub Security Advisory GHSA-qvfw-j98x-7q72 for the maintainer's technical write-up.
Detection Methods for CVE-2026-77063
Indicators of Compromise
- Application logs recording accepted uploads whose stored byte count equals the configured fileSize limit, indicating truncated but accepted files.
- Repeated multipart/form-data requests from a single client that carry Content-Length values well above the documented upload cap.
- Discrepancies between client-declared file sizes and server-side stored sizes on endpoints backed by multer.
Detection Strategies
- Perform dependency inventory against package-lock.json and yarn.lock to identify multer versions below 2.3.0.
- Static code review to locate multer({ fileFilter: async ... , limits: { fileSize: ... } }) patterns that combine async filters with size limits.
- Add server-side post-upload validation that re-checks stored file size against expected bounds and alerts on mismatches.
Monitoring Recommendations
- Instrument upload endpoints to emit metrics for rejected vs. accepted files, and alert on anomalous acceptance rates.
- Forward web server and application logs to a centralized analytics platform to correlate large Content-Length values with multer-backed routes.
- Track software composition analysis (SCA) findings for expressjs/multer and gate deployments on remediated versions.
How to Mitigate CVE-2026-77063
Immediate Actions Required
- Upgrade multer to version 2.3.0 or later across all Node.js services.
- Audit application code for async fileFilter implementations paired with limits.fileSize and validate behavior after upgrading.
- Add a defensive size check inside the request handler that rejects files whose received byte count reaches the configured limit.
Patch Information
The maintainers fixed CVE-2026-77063 in multer2.3.0. Refer to the OpenJS Foundation Security Advisories and the GitHub Security Advisory GHSA-qvfw-j98x-7q72 for release notes and the underlying commit history.
Workarounds
- Replace asynchronous fileFilter logic with a synchronous filter until the upgrade is deployed.
- Enforce upload size limits at the reverse proxy or load balancer (for example, client_max_body_size in NGINX) so oversized requests are rejected before reaching multer.
- Validate final file size on disk after multer completes and delete any file whose stored size equals or exceeds the configured fileSize limit.
# Configuration example: upgrade multer and pin the fixed version
npm install multer@^2.3.0
npm ls multer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.