grant/recap-relay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bump multer 1.4.5-lts.1 -> ^2.0.1 (DoS CVEs)

Browse Source 
multer 1.x is affected by CVE-2025-47944/47935/48997/7338 (malformed
multipart crashes the process / leaks memory). 2.x raises catchable
errors instead. Usage (diskStorage + .single("file")) is unchanged.
Commit the server lockfile so the Dockerfile's npm-ci path pins the fix.
This commit is contained in:
Keysat
2026-06-13 16:23:26 -05:00
parent d2caa98248
commit 3a601e166a
2 changed files with 1443 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/package-lock.json
Generated
+1442
View File
File diff suppressed because it is too large Load Diff
server/package.json
+1 -1
View File
@@ -12,7 +12,7 @@
"cors": "^2.8.5", "cors": "^2.8.5",
"cookie-parser": "^1.4.6", "cookie-parser": "^1.4.6",
"express": "^4.21.0", "express": "^4.21.0",
"multer": "^1.4.5-lts.1", "multer": "^2.0.1",
"undici": "^6.21.0" "undici": "^6.21.0"
} }
} }