expressjs

Records22All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high16CVSS 7.0–8.9

Exploited now

expressjs records in CISA KEV

No expressjs vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Multer 9 records MEDIUM Basic-auth-connect 1 record LOW Method-override 1 record LOW

Records

9 records in Multer · all components

TI-2026-03033 CVE-2026-3520 · GHSA-5528-5vmv-3xc2

Multer vulnerable to Denial of Service via uncontrolled recursion

MEDIUM 45

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00818 Published 2026-03-04 Partial fix · 2.1.1 CWE-674

TI-2026-02853 CVE-2026-3304 · GHSA-xf7r-hgr6-v32p

Multer vulnerable to Denial of Service via incomplete cleanup

MEDIUM 45

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00738 Published 2026-02-27 Partial fix · 2.1.0 CWE-459

TI-2026-01995 CVE-2026-2359 · GHSA-v52c-386h-88mc

Multer vulnerable to Denial of Service via resource exhaustion

MEDIUM 45

Multer is a node.js middleware for handling `multipart/form-data`.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00738 Published 2026-02-27 Partial fix · 2.1.0 CWE-772

TI-2026-56780 CVE-2026-82333 · GHSA-535w-7cp7-47q4

multer vulnerable to Denial of Service via oversized array index in field names

LOW 39

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00367 Published 2026-08-28 Partial fix · 2.3.0 CWE-400

TI-2026-53831 CVE-2026-77078 · GHSA-wc9g-mqfw-jrwm

multer vulnerable to Denial of Service via crafted multipart field names

LOW 39

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00488 Published 2026-08-28 Partial fix · 2.3.0 CWE-248

TI-2026-53816 CVE-2026-77037 · GHSA-qfvm-cv95-jqjf

multer vulnerable to Denial of Service via file descriptor leak on aborted uploads

LOW 39

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00457 Published 2026-08-28 Partial fix · 2.3.0 CWE-400

TI-2026-04434 CVE-2026-5079 · GHSA-72gw-mp4g-v24j

multer vulnerable to Denial of Service via deeply nested field names

LOW 39

Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00279 Published 2026-06-15 Partial fix · 2.2.0, 3.0.0-alpha.2 CWE-400

TI-2026-04396 CVE-2026-5038 · GHSA-3p4h-7m6x-2hcm

multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

LOW 39

Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00367 Published 2026-06-15 Partial fix · 2.2.0, 3.0.0-alpha.2 CWE-459

TI-2026-53818 CVE-2026-77063 · GHSA-qvfw-j98x-7q72

multer vulnerable to file size limit bypass via async fileFilter race condition

LOW 17

multer is a middleware for handling multipart/form-data in Node.js.

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00233 Published 2026-08-28 Partial fix · 2.3.0 CWE-362

Open these records in search →

Critical	0
High	16
Medium	5
Low	1
No CVSS	0