By vendor

Expressjs vulnerabilities

Known CVEs affecting Expressjs products, prioritized by severity, with SEC.co remediation and detection guidance.

2 published vulnerabilities

• CVE-2026-5079HIGH 7.5

  A vulnerability in the multer file upload library affects versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1. Attackers can craft a single HTTP request with deeply nested field names in form data to trigger excessive CPU and memory consumption, crashing or severely degrading the affected application. The issue stems from the append-field dependency parsing bracket notation without enforcing nesting limits. No user interaction or authentication is required to exploit this.

• CVE-2026-5038MEDIUM 5.3

  multer, a popular Node.js middleware for handling file uploads, has a resource exhaustion vulnerability affecting versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1. When a multipart upload is aborted or arrives malformed, the library fails to clean up temporary partial files from disk. An unauthenticated attacker can repeatedly trigger these failed uploads to consume disk space until the server runs out, causing a denial of service. No special application code flaws are needed—the vulnerability is inherent to how multer manages stream cleanup.