CVE-2026-77063

Katalog CVE

CVSS 3.7 · Low EPSS 0,23%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada expressjs multer. Skor CVSS 3.1 3.7 (Low) menurut CNA.

Deskripsi (NVD)

multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit to bypass the size-limit rejection. All versions before 2.3.0 are affected. The impact is limited because the underlying multipart parser still truncates the stream at the size limit, so this is a bypass of the limit rejection rather than uncontrolled resource consumption. The issue is fixed in multer 2.3.0. Upgrade to multer 2.3.0 to remediate.

Rincian

Terbit di NVD

28 Agustus 2026

Terakhir diubah

2 September 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 13,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cna.openjsf.org/security-advisories.html advisory vendor
• https://github.com/expressjs/multer/security/advisories/GHSA-qvfw-j98x-7q72 advisory vendor · mitigasi