Skip to content

🚨 [security] Update multer 2.0.0 → 2.0.2 (patch)#10

Closed
depfu[bot] wants to merge 1 commit intomainfrom
depfu/update/npm/multer-2.0.2
Closed

🚨 [security] Update multer 2.0.0 → 2.0.2 (patch)#10
depfu[bot] wants to merge 1 commit intomainfrom
depfu/update/npm/multer-2.0.2

Conversation

@depfu
Copy link
Contributor

@depfu depfu bot commented Jul 17, 2025 •
edited by sourcery-ai bot
Loading

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ multer (2.0.0 → 2.0.2) · Repo · Changelog

Security Advisories 🚨

🚨 Multer vulnerable to Denial of Service via unhandled exception from malformed request

Impact

A vulnerability in Multer versions >= 1.4.4-lts.1, < 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed request. This request causes an unhandled exception, leading to a crash of the process.

Patches

Users should upgrade to 2.0.2

Workarounds

None

🚨 Multer vulnerable to Denial of Service via unhandled exception

Impact

A vulnerability in Multer versions >=1.4.4-lts.1, <2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process.

Patches

Users should upgrade to 2.0.1

Workarounds

None

References

35a3272
#1233
#1256

Release Notes

2.0.1

Important

What's Changed

New Contributors

Full Changelog: v2.0.0...v.2.0.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 17 commits:

↗️ concat-stream (indirect, 1.6.2 → 2.0.0) · Repo

Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ readable-stream (indirect, 2.3.8 → 3.6.2) · Repo

Release Notes

3.6.2

What's Changed

Full Changelog: v3.6.1...v3.6.2

3.6.0

  • Fix babel loose mode for classes and update to Node v10.19.0 #428 by @ljharb

3.5.0

  • Update to Node v10.18.1 #420

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ string_decoder (indirect, 1.1.1 → 1.3.0) · Repo

Commits

See the full diff on Github. The new version differs by 8 commits:

🗑️ isarray (removed)

🗑️ process-nextick-args (removed)

🗑️ core-util-is (removed)

🗑️ safe-buffer (removed)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu cancel merge
Cancels automatic merging of this PR
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

Summary by Sourcery

Upgrade multer to 2.0.2 to address known security vulnerabilities.

Bug Fixes:

  • Bump multer from 2.0.0 to 2.0.2 to patch Denial of Service vulnerabilities.

Chores:

  • Regenerate package-lock.json to update transitive dependencies.

@depfu depfu bot added the depfu label Jul 17, 2025
@netlify
Copy link

netlify bot commented Jul 17, 2025 •
edited
Loading

✅ Deploy Preview for colorflux ready!

Name Link
🔨 Latest commit 0aa7423
🔍 Latest deploy log https://app.netlify.com/projects/colorflux/deploys/687973c47a164f0008b95772
😎 Deploy Preview https://deploy-preview-10--colorflux.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

@sourcery-ai
Copy link

sourcery-ai bot commented Jul 17, 2025 •
edited
Loading

Reviewer's Guide

This PR mitigates a critical Denial-of-Service vulnerability by bumping multer from 2.0.0 to 2.0.2 and regenerating the lock file, which in turn updates several indirect stream-related dependencies and prunes outdated packages.

File-Level Changes

Change Details Files
Upgrade multer to 2.0.2 to address security advisories
  • Change multer version specifier from ^2.0.0 to ^2.0.2 in package.json
  • Regenerate package-lock.json to pin multer@2.0.2
 package.json
package-lock.json
Refresh and prune indirect dependencies in package-lock.json
  • Bump concat-stream from 1.6.2 to 2.0.0
  • Bump readable-stream from 2.3.8 to 3.6.2
  • Bump string_decoder from 1.1.1 to 1.3.0
  • Remove legacy packages: isarray, process-nextick-args, core-util-is, safe-buffer
 package-lock.json
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@depfu depfu bot mentioned this pull request Jul 17, 2025
Closed
@depfu
Copy link
Contributor Author

depfu bot commented Feb 28, 2026

Closed in favor of #15.

@depfu depfu bot closed this Feb 28, 2026
@depfu depfu bot deleted the depfu/update/npm/multer-2.0.2 branch February 28, 2026 16:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

depfu

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants