DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-77063: CVE-2026-77063: File Size Limit Bypass via Asynchronous Race Condition in Multer

#security #cve #cybersecurity

CVE-2026-77063: File Size Limit Bypass via Asynchronous Race Condition in Multer

Vulnerability ID: CVE-2026-77063
CVSS Score: 3.7
Published: 2026-09-08

CVE-2026-77063 details a security flaw in multer, the standard multipart/form-data handler for Node.js, where asynchronous file filters introduce a race condition. This condition causes the library to miss file size limitation events, resulting in the silent acceptance of truncated files.

TL;DR

A race condition in multer occurs when an asynchronous fileFilter is configured alongside file size limits, allowing truncated file uploads to bypass rejection checks silently.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-362
  • Attack Vector: Network (AV:N)
  • CVSS v3.1: 3.7 (Low)
  • EPSS Score: 0.00160
  • Exploit Status: Proof of Concept available in codebase tests
  • CISA KEV Status: Not Listed

Affected Systems

  • Applications utilizing multer with configured fileSize limits and custom asynchronous fileFilter hooks.
  • multer: < 2.3.0 (Fixed in: 2.3.0)

Code Analysis

Commit: ab6aeae

Fix: file limit bypass when fileFilter is async

@@ -233,6 +233,9 @@ function makeMiddleware (setup) {\n     // handle files\n     busboy.on('file', function (fieldname, fileStream, { filename, encoding, mimeType }) {\n       var pendingWritesIncremented = false\n+      var aborting = false\n+      var accepted = false\n+      var fileSizeLimitReached = false
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub: Advisory context containing PoC references within test modules.

Mitigation Strategies

  • Upgrade multer to version 2.3.0 or later to ensure synchronous registration of limit event handlers.
  • Avoid the use of asynchronous handlers inside the fileFilter middleware hook.
  • Perform any necessary asynchronous validations downstream, post-upload, rather than inline inside the multer configuration.

Remediation Steps:

  1. Run 'npm install multer@latest' or update the package.json to reflect '^2.3.0'.
  2. Locate multer initialization configurations in the codebase and check for the presence of 'async' or Promise-based 'fileFilter' implementations.
  3. If present and upgrades are blocked, refactor 'fileFilter' to be synchronous and handle async operations in a subsequent express routing controller.

References

Read the full report for CVE-2026-77063 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)