Bug 2525796 (CVE-2026-77063)

Summary: CVE-2026-77063 multer: Multer: File size limit bypass via asynchronous file filter race condition
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: abarbaro, akostadi, alizardo, amasferr, dbosanac, dmayorov, dschmidt, gotiwari, ikhan, jcantril, jchui, jhe, jhorak, jlanda, jlledo, jreimann, kshier, ktsao, mdessi, mrizzi, mvyas, nboldt, oaljalju, pantinor, pcattana, psrna, rbobbitt, rhel-process-autobot, rojacob, simaishi, stcannon, tsedmik, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in multer, a software component used in Node.js applications to handle file uploads. When an application configures an asynchronous file filter along with a file size limit, a race condition can occur. This vulnerability allows a remote attacker to bypass the intended file size restrictions, enabling the processing of files that exceed the configured limit. Although the underlying parsing mechanism still truncates the oversized file, this flaw circumvents the initial rejection of such files.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2542098, 2542101, 2542103, 2542104, 2542105, 2542096, 2542097, 2542099, 2542102    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-28 22:02:45 UTC 
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.