GHSA-qvfw-j98x-7q72: Race Condition
Impact
When multer is configured with an asynchronous fileFilter, the limits.fileSize limit can be bypassed. The 'limit' event is registered inside the async fileFilter callback, so if a file exceeds limits.fileSize before that callback runs, the event is missed and the oversized upload is accepted instead of being rejected with a LIMITFILESIZE error. Applications that rely on limits.fileSize to reject oversized uploads are affected on all upload methods (.single(), .array(), .fields(), .any()). Uploads using a synchronous fileFilter are not affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
Use a synchronous fileFilter, or validate the uploaded file size after the upload completes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Upgrade
Upgrade
multerto a version that resolves this vulnerability.Fixed in 2.3.0 - Configuration
Configure multer with a synchronous fileFilter so oversized uploads are rejected before the async fileFilter registers the 'limit' event.
multer fileFilter (synchronous vs asynchronous) = synchronous - Compensating control
If you must use an asynchronous fileFilter, validate the uploaded file size after the upload completes to ensure oversized files are rejected (since the 'limit' event may be missed).
Event History
Frequently Asked Questions
Which deployments are affected?
Applications are affected only when multer uses an asynchronous fileFilter and relies on limits.fileSize to reject oversized uploads. The issue applies to .single(), .array(), .fields(), and .any() upload methods; synchronous fileFilter usage is not affected.
What must happen for an oversized upload to be accepted?
The uploaded file must exceed limits.fileSize before the asynchronous fileFilter callback runs. In that timing window, multer can miss the limit event and accept the file instead of returning a LIMIT_FILE_SIZE error.
What can be done if upgrading is not immediately possible?
Use a synchronous fileFilter, or validate the uploaded file size after the upload completes. These measures avoid relying on the asynchronous callback timing for file-size enforcement.
How can I determine whether my application is exposed?
Review multer upload handlers for an asynchronous fileFilter together with limits.fileSize. If both are configured, test whether an upload larger than the configured limit is accepted rather than rejected with LIMIT_FILE_SIZE.
What version includes the fix?
Upgrade multer to version 2.3.0.