zwave-js / zwave-js-ui / 36532128763

13%

push

github

chore(deps): update dependency multer to v2.4.0 (#4837)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [multer](https://redirect.github.com/expressjs/multer) | [`2.3.0` →
`2.4.0`](https://renovatebot.com/diffs/npm/multer/2.3.0/2.4.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/multer/2.4.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/multer/2.3.0/2.4.0?slim=true)
|

---

### multer vulnerable to Denial of Service via orphaned disk writes on
aborted uploads
[CVE-2026-88932](https://nvd.nist.gov/vuln/detail/CVE-2026-88932) /
[GHSA-3pph-fpjx-jg34](https://redirect.github.com/advisories/GHSA-3pph-fpjx-jg34)

<details>
<summary>More information</summary>

#### Details
##### Impact

Multer's `diskStorage` can leave complete, orphaned files on disk when a
multipart upload is aborted in the brief window before the storage
engine assigns the file path. This is an incomplete fix of
CVE-2026-5038: the earlier cleanup removes only in-flight uploads that
already have a path, so an upload aborted inside that window is written
to disk with nothing left to remove it, and the application is not given
a handle to clean it up. An unauthenticated attacker sending aborted
requests to any route backed by disk storage can accumulate orphaned
files until the upload directory or the shared system temporary
directory is exhausted. An asynchronous `destination` or `filename`
widens the window.

##### Patches

Users should upgrade to `2.4.0` or higher.

##### Workarounds

None.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L`

#### References
-
[https://github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34](https://redirect.github.com/expressjs/multer/security/advisories/GHSA-3pph-fpjx-jg34)
-
[https://... (continued)

537 of 4566 branches covered (11.76%)

Branch coverage included in aggregate %.

991 of 7044 relevant lines covered (14.07%)

2.2 hits per line