multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
Impact
A vulnerability in multer 2.2.0 allows an attacker to trigger a Denial of Service (DoS) by aborting or truncating multipart uploads. When using diskStorage, the destination write stream is not closed if the upload is aborted before it finishes, so each failed request leaks an open file descriptor and retains its disk blocks until the process exits. Repeated failed uploads can exhaust the available file descriptors. All applications using multer's disk storage are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
Impact
A vulnerability in Multer allows an attacker to trigger a Denial of Service (DoS) by aborting or sending malformed multipart uploads, causing orphaned partial files to accumulate on disk when using diskStorage.
Patches
Users should upgrade to 2.2.0, 3.0.0-alpha.2 or higher
Workarounds
None
body-parser is vulnerable to denial of service when url encoding is used
Impact
body-parser 2.2.0 is vulnerable to denial of service due to inefficient handling of URL-encoded bodies with very large numbers of parameters. An attacker can send payloads containing thousands of parameters within the default 100KB request size limit, causing elevated CPU and memory usage. This can lead to service slowdown or partial outages under sustained malicious traffic.
Patches
This issue is addressed in version 2.2.1.
Express ressource injection
A vulnerability has been identified in the Express response.links function, allowing for arbitrary resource injection in the Link header when unsanitized data is used.
The issue arises from improper sanitization in Link header values, which can allow a combination of characters like ,, ;, and <> to preload malicious resources.
This vulnerability is especially relevant for dynamic parameters.
body-parser vulnerable to denial of service when url encoding is enabled
Impact
body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.
Patches
this issue is patched in 1.20.3
References
multer vulnerable to Denial of Service via oversized array index in field names
Impact
multer is vulnerable to a Denial of Service (DoS) via a crafted array index in multipart field names. The append-field dependency parses bracket notation in field names, and a large numeric index such as items[4294967294] forces allocation of a maximum-length sparse array. A following field with a non-numeric key on the same base then converts that array to an object by iterating its full length, which consumes CPU synchronously and leaves the process unable to handle other requests. A single HTTP request with a crafted multipart body is sufficient to exploit this, and it affects multer 1.x and 2.x.
Patches
Users should upgrade to 2.3.0 and configure limits.fieldArrayIndexLimit to the minimum array index their application requires.
Workarounds
None.
multer vulnerable to Denial of Service via crafted multipart field names
Impact
A vulnerability in multer allows a remote, unauthenticated attacker to crash the Node.js process with a single multipart/form-data request. Two specially crafted text field names cause an uncaught RangeError: Invalid array length inside multer's field parsing, which is not routed to the application error handler and terminates the process. All applications using multer to parse multipart requests are affected.
Patches
Users should upgrade to 2.3.0.
Workarounds
None.
Mongoose: Prototype pollution in mongoose update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)
Impact
_What kind of vulnerability is it? Who is impacted?_
Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype.
Example:
``javascript
const mongoose = require('mongoose');
console.log('before:', Object.prototype.$fullPath); // undefined
const User = mongoose.model('User', new mongoose.Schema({ name: String }));
const malicious = JSON.parse('{"$set": {"__proto__.x": "anything"}}'); // attacker-controlled update
const q = User.updateOne({}, {});
try { q._castUpdate(malicious); } catch (e) { / throws AFTER the pollution side-effect / }
console.log('after :', Object.prototype.$fullPath); // "__proto__"
console.log('enumerable:', Object.prototype.propertyIsEnumerable('$fullPath')); // true
console.log('fresh {}:', ({}).$fullPath); // "__proto__"
`
Patches
_Has the problem been patched? What versions should users upgrade to?_
9.7.2, 8.24.1. 7.8.10, 6.13.10
Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
Check user-controlled updates for own __proto__` properties before passing to Mongoose
References
_Are there any links users can visit to find out more?_
Sequelize: SQL Injection (Oracle DB)
Summary
SQL Injection is possible with strings only if dialect is set to oracle.
The vulnerability was confirmed on Sequelize v6.37.3.
Details
The escape function defined in sql-string.js does not escape quotes if the value starts with TO_TIMESTAMP or TO_DATE.
``javascript
} else if (dialect === 'oracle' && typeof val === 'string') {
if (val.startsWith('TO_TIMESTAMP') || val.startsWith('TO_DATE')) {
return val;
}
val = val.replace(/'/g, "''");
}
`
PoC
Suppose the application has the following code:
`javascript
var result = await models.Student.findOne({
where: {
firstName: req.query.firstName
}
});
`
An attacker can inject arbitrary sql expressions.
http://host/path?firstName=TO_DATE('0','Y')||'' OR 1=1--
The resulted SQL will be:
`SQL
SELECT ... WHERE "Student"."firstName" = TO_DATE('0','Y')||'' OR 1=1-- ORDER BY "Student"."id" OFFSET 0 ROWS FETCH NEXT 1 ROWS ONLY;
``
Impact
Data theft and tampering.
Multer vulnerable to Denial of Service via deeply nested field names
Impact
Multer is vulnerable to a Denial of Service (DoS) via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names (e.g., a[b][c]) with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this.
Patches
Users should upgrade to 2.2.0 and configure limits.fieldNestingDepth to the minimum depth their application requires.
Workarounds
Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
lodash vulnerable to Code Injection via `_.template` imports key names
Impact
The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.
When an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.
Additionally, _.template use
Mongoose's Improper Sanitization of $nor in sanitizeFilter May Allow NoSQL Injection
Impact
This vulnerability allows bypassing Mongoose’s sanitizeFilter query sanitization mechanism via the $nor operator.
When sanitizeFilter is enabled, Mongoose wraps query operators in $eq to neutralize them. However, prior to the fix, $nor was not included in the set of logical operators that are recursively sanitized. Because $nor accepts an array (like $and and $or), and arrays do not trigger hasDollarKeys(), malicious operators such as $ne, $gt, or $regex could be
Multer Vulnerable to Denial of Service via Uncontrolled Recursion
Impact
A vulnerability in Multer versions < 2.1.1 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing stack overflow.
Patches
Users should upgrade to 2.1.1
Workarounds
None
Resources
https://github.com/expressjs/multer/security/advisories/GHSA-5528-5vmv-3xc2
https://www.cve.org/CVERecord?id=CVE-2026-3520
https://github.com/expressjs/multer/commit/7e66481f8b2e6c54b982b34c152479e096ce2752
https://cna.openjsf.or
Multer vulnerable to Denial of Service via incomplete cleanup
Impact
A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion.
Patches
Users should upgrade to 2.1.0
Workarounds
None
Sequelize v6 Vulnerable to SQL Injection via JSON Column Cast Type
Summary
SQL injection via unescaped cast type in JSON/JSONB where clause processing. The _traverseJSON() function splits JSON path keys on :: to extract a cast type, which is interpolated raw into CAST(... AS <type>) SQL. An attacker who controls JSON object keys can inject arbitrary SQL and exfiltrate data from any table.
Affected: v6.x through 6.37.7. v7 (@sequelize/core) is not affected.
Details
In src/dialects/abstract/query-generator.js, _traverseJSON() extracts a
lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and `_.omit`
Impact
Lodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.
The issue permits deletion of prototype properties but does not allow overwriting their original behavior.
Patches
This issue is patched in 4.18.0.
Workarounds
None. Upgrade to the patched version.
Multer vulnerable to Denial of Service via resource exhaustion
Impact
A vulnerability in Multer versions < 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion.
Patches
Users should upgrade to 2.1.0
Workarounds
None
Multer vulnerable to Denial of Service via unhandled exception from malformed request
Impact
A vulnerability in Multer versions >= 1.4.4-lts.1, < 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed request. This request causes an unhandled exception, leading to a crash of the process.
Patches
Users should upgrade to 2.0.2
Workarounds
None
Multer vulnerable to Denial of Service via unhandled exception
Impact
A vulnerability in Multer versions >=1.4.4-lts.1, <2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.
Patches
Users should upgrade to 2.0.1
Workarounds
None
References
https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
https://github.com/expressjs/multer/issues/1233
https://git
Multer vulnerable to Denial of Service from maliciously crafted requests
Impact
A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.
Patches
Users should upgrade to 2.0.0
Workarounds
None
References
https://github.com/expressjs/multer/issues/1176
https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
