# What changed in multer

> 35 changes in multer 2 from its official release notes, upgrade guides and advisories: 1 breaking, 11 security, 6 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/multer/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## multer 2

### Breaking changes

- Non-integer fileSize limits are rejected. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)

### Security

- Fixes the security issue identified as CVE-2026-88932. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0), [security advisory](https://github.com/advisories/GHSA-3PPH-FPJX-JG34)
- Fixes CVE-2026-77037. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0), [security advisory](https://github.com/advisories/GHSA-QFVM-CV95-JQJF)
- Fixes CVE-2026-77063. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0), [security advisory](https://github.com/advisories/GHSA-QVFW-J98X-7Q72)
- Fixes CVE-2026-77078. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0), [security advisory](https://github.com/advisories/GHSA-WC9G-MQFW-JRWM)
- Fixes CVE-2026-82333. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0), [security advisory](https://github.com/advisories/GHSA-535W-7CP7-47Q4)
- Fixes CVE-2026-5038, addressing a security vulnerability in multer. (2.2.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.2.0), [security advisory](https://github.com/advisories/GHSA-3P4H-7M6X-2HCM)
- Fixes CVE-2026-5079, addressing a security vulnerability in multer. (2.2.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.2.0), [security advisory](https://github.com/advisories/GHSA-72GW-MP4G-V24J)
- Fixes CVE-2026-3520. (2.1.1) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.1.1), [security advisory](https://github.com/advisories/GHSA-5528-5VMV-3XC2)
- Multer Vulnerable to Denial of Service via Uncontrolled Recursion (2.1.1) — [security advisory](https://github.com/advisories/GHSA-5528-5VMV-3XC2)
- Multer vulnerable to Denial of Service via incomplete cleanup (2.1.0) — [security advisory](https://github.com/advisories/GHSA-XF7R-HGR6-V32P)
- Multer vulnerable to Denial of Service via resource exhaustion (2.1.0) — [security advisory](https://github.com/advisories/GHSA-V52C-386H-88MC)

### New APIs and options

- Multer exposes Busboy's defCharset option. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Adds a flush option to disk storage to fsync files before completion. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Multer exposes Busboy's fileHwm option. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Multer exposes Busboy's highWaterMark option. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Lets you choose how the request body reaches Busboy, enabling parsing of pre-consumed bodies such as Google Cloud Functions and Firebase rawBody. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Adds an opt-in fieldArrayIndexLimit option. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0)

### Behavior and default changes

- diskStorage can now be used without options. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- File errors now include the filename. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- The limits option now accepts a function. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Adds support for UTF-8 headers. (2.1.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.1.0)

### Fixes and other changes

- Escaped field names are decoded, not just filenames. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Escaped filenames are decoded when reporting LIMIT_FILE_SIZE. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Improves the wording for the LIMIT_UNEXPECTED_FILE error code. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- All limits are validated when multer is constructed. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Uploads can contain exactly the configured number of parts. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Files skipped by fileFilter no longer consume a maxCount slot. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- A maxCount slot is reserved before yielding to an asynchronous fileFilter. (2.4.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.4.0)
- Preserves async hooks context in supported environments. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0)
- Falls back to the error code when no message mapping exists. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0)
- Prevents a process crash if fileFilter calls its callback more than once. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0)
- Allows files whose size is exactly at the fileSize limit. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0)
- Decodes WHATWG-escaped characters in file originalname. (2.3.0) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.3.0)
- Fixes error and abort handling. (2.1.1) — [release notes](https://github.com/expressjs/multer/releases/tag/v2.1.1)