Skip to content

fix: validate fileSize is integer to prevent limit bypass#1395

Open
abhu85 wants to merge 1 commit intoexpressjs:mainfrom
abhu85:fix/1132-validate-filesize-integer
Open

fix: validate fileSize is integer to prevent limit bypass#1395
abhu85 wants to merge 1 commit intoexpressjs:mainfrom
abhu85:fix/1132-validate-filesize-integer

Conversation

@abhu85
Copy link
Copy Markdown

@abhu85 abhu85 commented Apr 29, 2026

Summary

Validate that fileSize limit is an integer to prevent silent limit bypass with floating-point values.

Problem

When limits.fileSize is a floating-point number (e.g., 1024.1), busboy does not enforce the limit correctly, allowing files larger than intended to be uploaded.

Solution

Add input validation in the Multer constructor to throw a TypeError if fileSize is not an integer, matching the behavior in multer v3. The check uses Number.isInteger() and only applies when fileSize is explicitly provided (non-null).

Test Plan

  • fileSize: 1024.5 throws TypeError
  • fileSize: 1024 works normally
  • Existing tests pass (74/74)

Fixes #1132

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

MulterError: File too large not thrown when fileSize is floating point

1 participant