npm / multer

multer

What changed in multer 2, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.

1 breaking11 security6 new APIs and options4 behavior and defaults13 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

multer 235 changes

Fixes the security issue identified as CVE-2026-88932.
2.4.0release notes security advisory
Fixes CVE-2026-77037.
2.3.0release notes security advisory
Fixes CVE-2026-77063.
2.3.0release notes security advisory
Fixes CVE-2026-77078.
2.3.0release notes security advisory
Fixes CVE-2026-82333.
2.3.0release notes security advisory
Fixes CVE-2026-5038, addressing a security vulnerability in multer.
2.2.0release notes security advisory
Fixes CVE-2026-5079, addressing a security vulnerability in multer.
2.2.0release notes security advisory
Fixes CVE-2026-3520.
2.1.1release notes security advisory
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
2.1.1security advisory
Multer vulnerable to Denial of Service via incomplete cleanup
2.1.0security advisory
Multer vulnerable to Denial of Service via resource exhaustion
2.1.0security advisory

Multer exposes Busboy's defCharset option.
2.4.0release notes
Adds a flush option to disk storage to fsync files before completion.
2.4.0release notes
Multer exposes Busboy's fileHwm option.
2.4.0release notes
Multer exposes Busboy's highWaterMark option.
2.4.0release notes
Lets you choose how the request body reaches Busboy, enabling parsing of pre-consumed bodies such as Google Cloud Functions and Firebase rawBody.
2.4.0release notes
Adds an opt-in fieldArrayIndexLimit option.
2.3.0release notes

Escaped field names are decoded, not just filenames.
2.4.0release notes
Escaped filenames are decoded when reporting LIMIT_FILE_SIZE.
2.4.0release notes
Improves the wording for the LIMIT_UNEXPECTED_FILE error code.
2.4.0release notes
All limits are validated when multer is constructed.
2.4.0release notes
Uploads can contain exactly the configured number of parts.
2.4.0release notes
Files skipped by fileFilter no longer consume a maxCount slot.
2.4.0release notes
A maxCount slot is reserved before yielding to an asynchronous fileFilter.
2.4.0release notes
Preserves async hooks context in supported environments.
2.3.0release notes
Falls back to the error code when no message mapping exists.
2.3.0release notes
Prevents a process crash if fileFilter calls its callback more than once.
2.3.0release notes
Allows files whose size is exactly at the fileSize limit.
2.3.0release notes
Decodes WHATWG-escaped characters in file originalname.
2.3.0release notes
Fixes error and abort handling.
2.1.1release notes