fix(deps): update dependency multer to v2 [security] - autoclosed #3724
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub. |
|
Codecov ReportAll modified and coverable lines are covered by tests ✅
❗ Your organization needs to install the Codecov GitHub app to enable full functionality. Additional details and impacted files@@ Coverage Diff @@
## master #3724 +/- ##
==========================================
- Coverage 65.52% 65.51% -0.01%
==========================================
Files 958 958
Lines 15925 15925
Branches 2206 2205 -1
==========================================
- Hits 10435 10434 -1
- Misses 5149 5443 +294
+ Partials 341 48 -293 see 127 files with indirect coverage changes Continue to review full report in Codecov by Sentry.
🚀 New features to boost your workflow:
|
renovate
bot
changed the title
This PR contains the following updates:
^1.4.4->^2.0.0GitHub Vulnerability Alerts
CVE-2025-47935
Impact
Multer <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal
busboystream is not closed, violating Node.js stream safety guidance.This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted.
Patches
Users should upgrade to
2.0.0Workarounds
None
References
CVE-2025-47944
Impact
A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.
Patches
Users should upgrade to
2.0.0Workarounds
None
References
Release Notes
expressjs/multer (multer)
v2.0.0Compare Source
Important
What's Changed
Configuration
📅 Schedule: Branch creation - "" in timezone Europe/Paris, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.