Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

expressjs/multer

              main @ 2e2af08
            

Fixes

CVEs

HIGH

Peak severity

Highlights

Denial of Service: 16 prior fixes. Scrutinize any change in this area.

lib/make-middleware.js: most-fixed (14 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Uncaught errors generated during Busboy initialization or when handling malformed multipart headers and unhandled stream errors can crash the entire Node.js server process. Securely wrapping parser setup and registering stream error handlers early are critical to preventing remote process termination.

Denial of Service: Aborted connections, request failures, or asynchronous callback race conditions can leave temporary disk writes uncleaned or leave incoming streams undrained. This allows remote attackers to exhaust server disk space and socket resources, a hazard recognized under CVE-2026-5038 and CVE-2026-2359.

Denial of Service: Incoming payloads parsing fields with missing names or highly-nested object structures can trigger unhandled type errors or consume extreme CPU and memory, leading to server crashes (CVE-2026-5079).