zwave-js / zwave-js-ui / 34311022084

13%

push

github

chore(deps): update dependency multer to v2.3.0 (#4821)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [multer](https://redirect.github.com/expressjs/multer) | [`2.2.0` →
`2.3.0`](https://renovatebot.com/diffs/npm/multer/2.2.0/2.3.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/multer/2.3.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/multer/2.2.0/2.3.0?slim=true)
|

---

### multer vulnerable to Denial of Service via file descriptor leak on
aborted uploads
[CVE-2026-77037](https://nvd.nist.gov/vuln/detail/CVE-2026-77037) /
[GHSA-qfvm-cv95-jqjf](https://redirect.github.com/advisories/GHSA-qfvm-cv95-jqjf)

<details>
<summary>More information</summary>

#### Details
##### Impact

A vulnerability in multer `2.2.0` allows an attacker to trigger a Denial
of Service (DoS) by aborting or truncating multipart uploads. When using
`diskStorage`, the destination write stream is not closed if the upload
is aborted before it finishes, so each failed request leaks an open file
descriptor and retains its disk blocks until the process exits. Repeated
failed uploads can exhaust the available file descriptors. All
applications using multer's disk storage are affected.

##### Patches

Users should upgrade to `2.3.0`.

##### Workarounds

None.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf](https://redirect.github.com/expressjs/multer/security/advisories/GHSA-qfvm-cv95-jqjf)
-
[https://nvd.nist.gov/vuln/detail/CVE-2026-77037](https://nvd.nist.gov/vuln/detail/CVE-2026-77037)
-
[https://github.com/expressjs/multer/commit/eef74440b](https://redirect.github.com/expressjs/multer/commit/eef7... (continued)

537 of 4566 branches covered (11.76%)

Branch coverage included in aggregate %.

991 of 7044 relevant lines covered (14.07%)

2.2 hits per line