multer EUVD-2026-67929

Exploitation requires the target application to be configured with BOTH an asynchronous fileFilter callback AND a fileSize limit option in the multer middleware configuration - applications using only one of these two settings are not vulnerable. The race condition is timing-dependent (CVSS AC:H), meaning exploitation is not reliably reproducible on every request and requires favorable scheduling conditions in the Node.js event loop. The CVSS vector PR:N indicates no authentication is required from multer's perspective, but application-level authentication on the upload endpoint would limit the attacker pool to authenticated users. The achieved outcome is limited: the underlying multipart parser truncates the data, so a complete oversized file cannot be delivered. Exploitation is further constrained to versions of multer strictly below 2.3.0.

CVSS 3.1 scores this at 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N. The High Attack Complexity correctly reflects the race condition timing requirement, and the Low integrity impact accurately captures the bounded nature of the bypass - the file data is still truncated by the underlying parser, so the attacker cannot deliver a complete oversized file. No KEV listing and no public exploit or POC have been identified at time of analysis. EPSS data is not present in the provided intelligence. Real-world priority is low: successful exploitation requires both a specific application configuration (async fileFilter and fileSize limit used together) and precise race condition timing, and the achieved impact is a logic bypass rather than code execution, data theft, or denial of service. This is a correctness issue in upload enforcement logic, not a critical attack surface. Organizations with strict file size enforcement as a security control (e.g., preventing malicious payload delivery) should treat this as a medium operational priority despite the low CVSS.

An attacker submits a multipart/form-data upload request containing a file that exceeds the application's configured fileSize limit. Because the application uses an asynchronous fileFilter (e.g., one that queries a database to validate the upload), a race condition between the async callback resolution and the stream size-limit signaling allows multer to pass the file reference to the application before the rejection fires. The file data received is still truncated by busboy at the limit, so the attacker cannot deliver arbitrary-size content, but the application's upload handler processes the request as if the file were accepted. No public POC has been identified at time of analysis.