zwave-js / zwave-js-ui / 40323974673

18%

push

github

chore(deps): update dependency multer to v2.5.0 (#4884)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [multer](https://redirect.github.com/expressjs/multer) | [`2.4.0` →
`2.5.0`](https://renovatebot.com/diffs/npm/multer/2.4.0/2.5.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/multer/2.5.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/multer/2.4.0/2.5.0?slim=true)
|

---

### multer vulnerable to Denial of Service via a pending asynchronous
fileFilter after request teardown
[CVE-2026-113872](https://nvd.nist.gov/vuln/detail/CVE-2026-113872) /
[GHSA-q7qp-rjg7-q26m](https://redirect.github.com/advisories/GHSA-q7qp-rjg7-q26m)

<details>
<summary>More information</summary>

#### Details
##### Impact

When `multer` is configured with an asynchronous `fileFilter`, a single
request can crash the Node.js process. If a request is aborted (for
example when one file is rejected) while another file's async
`fileFilter` is still pending, the pending callback later resumes a
parsing stream that multer has already torn down. busboy then emits an
error on a stream that no longer has an error listener, which Node
raises as an unhandled `'error'` event, and the process exits. A single
unauthenticated request is enough, so any application using `multer`
with an asynchronous `fileFilter` is affected, regardless of storage
engine. Uploads using a synchronous `fileFilter` are not affected.

##### Patches

Users should upgrade to `multer` `2.5.0` or later.

##### Workarounds

Use a synchronous `fileFilter`.

#### Severity
- CVSS Score: 7.5 / 10 (High)
- Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

#### References
-
[https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m](https://redirect.github.com/expressjs/multer/security/advisories/... (continued)

723 of 4595 branches covered (15.73%)

Branch coverage included in aggregate %.

1257 of 7086 relevant lines covered (17.74%)

2.57 hits per line