Homepage

multer@2.0.0-alpha.4 vulnerabilities

Middleware for handling `multipart/form-data`.

  • latest version

    2.0.2

  • latest non vulnerable version

    3.0.0-alpha.1

  • first published

    11 years ago

  • latest version published

    2 months ago

  • licenses detected

  • View multer package health on Snyk Advisor  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the multer package. This does not include vulnerabilities belonging to this package’s dependencies.

    How to fix?

    Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Uncaught Exception

    Affected versions of this package are vulnerable to Uncaught Exception due to improper handling of multipart requests. An attacker can cause the application to crash by sending a specially crafted malformed multi-part upload request that triggers an unhandled exception.

    How to fix Uncaught Exception?

    Upgrade multer to version 2.0.2 or higher.

    >=1.4.4-lts.1 <2.0.2
    • C
    Uncaught Exception

    Affected versions of this package are vulnerable to Uncaught Exception in makeMiddleware, when processing a file upload request. An attacker can cause the application to crash by sending a request with a field name containing an empty string.

    How to fix Uncaught Exception?

    Upgrade multer to version 2.0.1 or higher.

    <2.0.1
    • H
    Uncaught Exception

    Affected versions of this package are vulnerable to Uncaught Exception due to an error event thrown by busboy. An attacker can cause a full nodejs application to crash by sending a specially crafted multi-part upload request.

    How to fix Uncaught Exception?

    Upgrade multer to version 2.0.0 or higher.

    <2.0.0
    • H
    Missing Release of Memory after Effective Lifetime

    Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime due to improper handling of error events in HTTP request streams, which fails to close the internal busboy stream. An attacker can cause a denial of service by repeatedly triggering errors in file upload streams, leading to resource exhaustion and memory leaks.

    Note:

    This is only exploitable if the server is handling file uploads.

    How to fix Missing Release of Memory after Effective Lifetime?

    Upgrade multer to version 2.0.0 or higher.

    <2.0.0
    Go back to all versions of this package