Listen to this Post
The multer middleware for Node.js is widely used to handle multipart/form‑data, specifically file uploads. It provides a `limits.fileSize` option to restrict the maximum allowed file size. However, a race condition exists when an asynchronous `fileFilter` function is defined. When a client uploads a file, multer processes the stream and checks the size against the limit. The `’limit’` event, which triggers the `LIMIT_FILE_SIZE` error, is attached inside the callback of the asynchronous fileFilter. If the file upload surpasses the size limit before the asynchronous `fileFilter` callback resolves, the `’limit’` event listener is not yet registered. Consequently, the error event is missed, and multer continues processing the oversized file. This bypass affects all upload methods: .single(), .array(), .fields(), and .any(). The vulnerability arises because the event registration occurs after the stream starts reading data. An attacker can exploit this by sending a large file that exceeds the limit, combined with a delayed asynchronous filter operation (e.g., querying a database, external API, or using setTimeout). The file will be accepted, and subsequent middleware or route handlers will receive the oversized file, potentially leading to denial of service, storage exhaustion, or other security implications. Synchronous `fileFilter` functions are unaffected because the event is registered immediately. The issue was reported and fixed in multer version 2.3.0. The advisory was published on August 28, 2026, and updated on September 8, 2026. Users who cannot upgrade should use a synchronous filter or manually validate file size after upload completion. The severity is rated low due to the specific conditions required (async filter + large file + timing), but it can be chained with other issues for higher impact.
DailyCVE Form:
Platform: Node.js multer
Version: < 2.3.0
Vulnerability: Size Limit Bypass
Severity: Low
Date: Aug 28 2026
Prediction: Patch released Sep8
What Undercode Say:
Analytics – Bash commands and code to identify vulnerable installations and test the condition:
Check installed multer version
npm list multer
Identify vulnerable versions (all before 2.3.0)
npm view multer versions --json | grep -E '"2.[0-2].[0-9]"'
Simulate a delayed async filter (Node.js snippet)
cat > test-race.js << 'EOF'
const multer = require('multer');
const upload = multer({
limits: { fileSize: 1024 },
fileFilter: (req, file, cb) => {
setTimeout(() => cb(null, true), 5000); // async delay
}
});
app.post('/upload', upload.single('file'), (req, res) => {
console.log('File accepted, size:', req.file.size);
});
EOF
Send an oversized file (e.g., 10MB) with curl
dd if=/dev/zero of=large.bin bs=1M count=10
curl -F "[email protected]" http://localhost:3000/upload
Exploit: (Educational Purposes!)
To trigger the bypass, an attacker sends a file larger than `limits.fileSize` while ensuring the `fileFilter` is asynchronous and takes longer to resolve than the time needed for the file stream to exceed the limit. For example, using a `setTimeout` inside the filter or performing a slow database lookup. The `’limit’` event is registered only after the filter callback finishes, so the oversized stream finishes before the listener exists, and multer never emits the error. The file is then written to disk or memory and passed to the route handler, evading the intended restriction.
Protection:
- Upgrade multer to version 2.3.0 or later immediately.
- If upgrade is not possible, replace the asynchronous `fileFilter` with a synchronous version (no callbacks, just return boolean).
- As a workaround, validate `req.file.size` inside the route handler and reject requests that exceed your desired limit after the upload completes.
- Monitor disk usage and implement a cleanup routine for orphaned uploads.
Impact:
- Denial of service via disk space exhaustion or memory overflow.
- Potential storage amplification attacks if the application stores the file without further validation.
- Bypass of business logic that relies on file size restrictions (e.g., quota systems).
- Low severity but can be combined with other vulnerabilities to escalate risk (e.g., large file causing parser timeouts or crash).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
