A race condition in Multer’s handling of asynchronous fileFilter callbacks allows an attacker to upload a file larger than the configured size limit while the size‑limit rejection is skipped. The underlying multipart parser still truncates the data stream, so the file is not larger on disk; the issue enables a bypass of the configured limit rejection rather than causing uncontrolled resource consumption.

All released Multer versions prior to 2.3.0, a middleware used in Node.js applications for handling multipart/form‑data, are affected. The vulnerable functionality is tied to usage of an asynchronous fileFilter in conjunction with the fileSize limit option.

The vulnerability carries a CVSS score of 3.7 and is not listed in the CISA KEV catalog. No EPSS score is available, suggesting limited published exploitation. Attackers can exploit the condition by sending a multipart POST request that includes a large file while using Multer’s asynchronous fileFilter; the bypass occurs before the size check is applied and is therefore a low‑to‑moderate risk for applications that rely solely on that check.