Known vulnerabilities in multer

Vendor: Express.js
Software: multer
Software CPE: cpe:2.3:a:expressjs:multer:*:*:*:*:*:*:*:*
Website: https://expressjs.com/
Total vulnerabilities: 13
Public exploits: 0
Known exploited (KEV): 0
Highest CVSSv4 Score: 8.8

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting multer multer is affected by 13 known vulnerabilities: 1 high, 11 medium, 1 low Critical High Medium Low

Vulnerabilities (13)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU146781 - Incomplete cleanup
CVE-2026-77037		 CWE-459 Medium
No
No
 2.3.0 02.09.2026 SB2026090288
#VU146780 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2026-77063		 CWE-362 Low
No
No
 2.3.0 02.09.2026 SB2026090288
#VU146779 - Uncaught Exception
CVE-2026-77078		 CWE-248 Medium
No
No
 2.3.0 02.09.2026 SB2026090288
#VU146778 - Resource exhaustion
CVE-2026-82333		 CWE-400 Medium
No
No
 2.3.0 02.09.2026 SB2026090288
#VU134533 - Resource exhaustion
CVE-2026-5079		 CWE-400 Medium
No
No
 2.2.0, 3.0.0.2 15.06.2026 SB2026061544
SB2026072414
#VU134532 - Incomplete cleanup
CVE-2026-5038		 CWE-459 Medium
No
No
 2.2.0, 3.0.0.2 15.06.2026 SB2026061544
SB2026072414
#VU128187 - Uncontrolled Recursion
CVE-2026-3520		 CWE-674 Medium
No
No
 2.1.1 27.04.2026 SB20260427156
SB2026042940
SB2026081816
#VU128186 - Missing Release of Resource after Effective Lifetime
CVE-2026-2359		 CWE-772 Medium
No
No
 2.1.0 27.04.2026 SB20260427155
SB2026042940
SB2026081816
#VU128185 - Incomplete cleanup
CVE-2026-3304		 CWE-459 Medium
No
No
 2.1.0 27.04.2026 SB20260427155
SB2026042940
SB2026081816
#VU113227 - Uncaught Exception
CVE-2025-48997		 CWE-248 Medium
No
No
 2.0.1 25.07.2025 SB2025072557
SB2025072558
SB2025082202
and 9 more
#VU113032 - Uncaught Exception
CVE-2025-7338		 CWE-248 Medium
No
No
 2.0.2 18.07.2025 SB2025071811
SB2025082823
SB2025091818
and 8 more
#VU111106 - Uncaught Exception
CVE-2025-47944		 CWE-248 Medium
No
No
 2.0.0 12.06.2025 SB2025061251
SB2025061252
SB2025062505
and 12 more
#VU111105 - Missing release of memory after effective lifetime
CVE-2025-47935		 CWE-401 High
No
No
 2.0.0 12.06.2025 SB2025061250
SB2025061252
SB2025062505
and 13 more