PT-2025-22069

Name of the Vulnerable Software and Affected Versions: Multer versions 1.4.4-lts.1 through 1.4.4-lts.x and versions prior to 2.0.0 Description: A Denial of Service DoS issue is present, allowing an attacker to trigger a crash of the process by sending a malformed multi-part upload request, causin...

PT-2025-22068

Name of the Vulnerable Software and Affected Versions: Multer versions prior to 2.0.0 Description: The issue is related to improper stream handling in Multer, a node.js middleware for handling multipart/form-data. This leads to a resource exhaustion and memory leak issue when the HTTP request...

Multer 安全漏洞

Multer is an expressjs open source middleware for Node.js. A security vulnerability exists in Multer versions prior to 2.0.0, which stems from improper handling of streams and could lead to resource exhaustion and memory leaks...

Multer 安全漏洞

Multer is an expressjs open source middleware for Node.js. A security vulnerability exists in Multer versions prior to 2.0.0 that could lead to a denial of service when processing malformed multipart upload requests...

CVE-2024-11171

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-11171

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-11171 Improper Input Validation in danny-avila/librechat

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-11171 Improper Input Validation in danny-avila/librechat

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-11171 Improper Input Validation in danny-avila/librechat

In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...

CVE-2024-11171

CVE-2024-11171 affects danny-avila/librechat (git 0c2a583). The vulnerability arises from improper input validation and the use of multer with in-memory storage, which has no file size limit, allowing an attacker to trigger out-of-memory conditions and a DoS. The issue is fixed in version 0.7.6. ...

CVE-2024-11170 Path Traversal in danny-avila/librechat

A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. This can lead to arbitrary file write and potentially remote code execution. The issue is fixed in version 0.7.6...

PT-2025-12102

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6 Description The issue is related to improper input validation, specifically with the handling of multipart file uploads using multer middleware. When in-memory storage is used, there is no limit on...

CVE-2024-13059

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when...

CVE-2024-13059

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when...

CVE-2024-13059 Path Traversal in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. This vulnerability can lead to arbitrary file write, which can subsequently result in remote code execution. The issue arises when...

CVE-2024-13059

CVE-2024-13059 affects mintplex-labs/anything-llm prior to 1.3.1. The vulnerability arises from improper handling of non-ASCII filenames in the multer library, where filename transformations can introduce ../ sequences that are not sanitized. This enables path traversal and arbitrary file writes ...

anything-llm 安全漏洞

anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. A security vulnerability exists in versions of anything-llm prior to 1.3.1, which stems from the multer library's mishandling of path traversal for non-ASCII filenames, which could lead to arbitrary file...

PT-2025-6084

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 1.3.1 Description: A vulnerability exists in mintplex-labs/anything-llm due to improper handling of non-ASCII filenames within the multer library. This can lead to path traversal, allowing attacker...

Malicious code in react-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 876139b096ddb1bf239489a666a6248e65ba5512906c207b40104c7efe2f1616 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12031 Malicious code in react-multer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 876139b096ddb1bf239489a666a6248e65ba5512906c207b40104c7efe2f1616 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...