StackRadar

CVE-2026-77063

Low

Advisory

Published 8 Sept 2026In the index since 9 Sept 2026
Severity
Low
worst across findings
CVSS
3.7
base score, highest
EPSS
0.002
6th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
141
of 17,781 indexed, latest versions
Container images
138
deployed by those charts
Fix available
1 of 1
affected package

multer vulnerable to file size limit bypass via async fileFilter race condition

Carried by container images the latest versions of 141 of 17,781 indexed charts deploy, on 138 images.

Affected packageAffected versionsFixed inImages
multernpm0.1.8, 1.3.0, 1.4.1, 1.4.2+9 more2.3.0138
OSV records
GHSA-qvfw-j98x-7q72

Charts affected

141 by stars
ChartLatestAffected imagesRadar Score
ghostkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 2See more

ghost kubernetes-homelab-helm-charts 0.1.2

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
library/ghost:6.39.0-alpine77196da4b0df
multer@2.1.1
2.3.0

Open the chart page →

2,756
seerrkubernetes-homelab-helm-chartsVerified publisher0.1.21 of 1See more

seerr kubernetes-homelab-helm-charts 0.1.2

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
multer@1.4.5-lts.1
2.3.0

Open the chart page →

2,548
jellyseerrlbenicio-communityVerified publisher0.1.01 of 1See more

jellyseerr lbenicio-community 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
fallenbagel/jellyseerr:latest4538137bc5af
multer@1.4.5-lts.1
2.3.0

Open the chart page →

3,555
node-redlmatfyVerified publisher0.1.61 of 1See more

node-red lmatfy 0.1.6

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
nodered/node-red:4.1.10-minimald73ae167cb9b
multer@2.1.1
2.3.0

Open the chart page →

1,809
redisinsightlogic3579Verified publisher3.4.01 of 1See more

redisinsight logic3579 3.4.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
redis/redisinsight:3.485562d67a912
multer@2.0.2
2.3.0

Open the chart page →

1,490
m9sweeperm9sweeperVerified publisher1.6.01 of 6See more

m9sweeper m9sweeper 1.6.0

1 of the 6 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
multer@1.4.4-lts.1
2.3.0

Open the chart page →

9,774
nodecg-chartmarathon-charts0.1.51 of 2See more

nodecg-chart marathon-charts 0.1.5

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/rodg/nodecg-base:latest31be4bf87070
multer@1.4.5-lts.1
2.3.0

Open the chart page →

7,315
backstagemcwarmanVerified publisher0.10.101 of 2See more

backstage mcwarman 0.10.10

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
multer@1.4.5-lts.1
2.3.0

Open the chart page →

9,668
ghostmt1905028.25.11 of 3See more

ghost mt190502 8.25.1

1 of the 3 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
library/ghost:6.25.12654b1e90413
multer@2.1.1
2.3.0

Open the chart page →

4,960
n8nn8n-openshiftVerified publisher1.18.01 of 1See more

n8n n8n-openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
multer@2.2.0
2.3.0

Open the chart page →

1,038
smilencsaVerified publisher1.1.01 of 23See more

smile ncsa 1.1.0

1 of the 23 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
socialmediamacroscope/smile_server:0.3.31a528c794270
multer@1.4.1
2.3.0

Open the chart page →

109,294
papergirlneoskop3.2.61 of 5See more

papergirl neoskop 3.2.6

1 of the 5 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
neoskop/papergirl:3.2.67f52b5949f03
multer@1.4.4-lts.1
2.3.0

Open the chart page →

6,982
nocodbone-acre-fundVerified publisher0.4.61 of 3See more

nocodb one-acre-fund 0.4.6

1 of the 3 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
nocodb/nocodb:0.258.06779a4ddedf2
multer@1.4.4-lts.1
2.3.0

Open the chart page →

4,219
n8nopenshift1.18.01 of 1See more

n8n openshift 1.18.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
n8nio/n8n:2.36.714c4285bc303
multer@2.2.0
2.3.0

Open the chart page →

1,038
outscale-s3-exploreroutscale-s3-explorer0.1.41 of 1See more

outscale-s3-explorer outscale-s3-explorer 0.1.4

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
multer@1.4.5-lts.2
2.3.0

Open the chart page →

1,811
mishtip2p-avs0.1.01 of 2See more

mishti p2p-avs 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
mishtinetwork/operator:latestbb3fe67a5f7c
multer@1.4.4-lts.1
2.3.0

Open the chart page →

3,999
ungatep2p-avs0.1.01 of 3See more

ungate p2p-avs 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
xom4ekp2p/infini-route-attestators-public-mainnet-attester:latestd0e0aa238b02
multer@1.4.4-lts.1
2.3.0

Open the chart page →

27,373
prismeai-coreprismeai1.12.12 of 7See more

prismeai-core prismeai 1.12.1

2 of the 7 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod470da8f8730c
multer@2.2.0
2.3.0
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
multer@2.2.0
2.3.0

Open the chart page →

3,270
recipe-apprecipe-app0.1.01 of 2See more

recipe-app recipe-app 0.1.0

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
anamskenneth/recipe_backend:2025-06-079b7d2cd389b7
multer@1.4.5-lts.1
2.3.0

Open the chart page →

3,271
redisinsightredisinsightVerified publisher0.1.01 of 1See more

redisinsight redisinsight 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.3.0

Open the chart page →

1,038
redisinsightredisinsight-helmVerified publisher0.1.11 of 1See more

redisinsight redisinsight-helm 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
redis/redisinsight:2.46699d341bd329
multer@1.4.4-lts.1
2.3.0

Open the chart page →

1,884
relfinder-reformedrelfinderreformed2.0.01 of 2See more

relfinder-reformed relfinderreformed 2.0.0

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
multer@1.4.4-lts.1
2.3.0

Open the chart page →

6,282
safe-stacksafe-global0.1.01 of 9See more

safe-stack safe-global 0.1.0

1 of the 9 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
safeglobal/safe-client-gateway-nest:v1.51.012ccfd93fcaf
multer@1.4.4-lts.1
2.3.0

Open the chart page →

19,560
unifi-protectschichtelVerified publisher0.10.11 of 1See more

unifi-protect schichtel 0.10.1

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
markdegroot/unifi-protect-arm64:latestd8445f2a0de6
multer@1.4.5-lts.1
2.3.0

Open the chart page →

5,582
seerr-chartseerr-chartVerified publisher3.9.11 of 1See more

seerr-chart seerr-chart 3.9.1

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
ghcr.io/seerr-team/seerr:v3.4.1f4768de5f616
multer@2.1.1
2.3.0

Open the chart page →

1,991
retail-store-sample-checkout-chartstacksimplifyVerified publisher1.0.01 of 1See more

retail-store-sample-checkout-chart stacksimplify 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
multer@2.0.1
2.3.0

Open the chart page →

1,313
chatqnatest-opea1.0.01 of 11See more

chatqna test-opea 1.0.0

1 of the 11 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
multer@1.4.4-lts.1
2.3.0

Open the chart page →

39,090
redis-vector-dbtest-opea1.0.01 of 1See more

redis-vector-db test-opea 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
redis/redis-stack:7.2.0-v91c5f43fddcdd
multer@1.4.4-lts.1
2.3.0

Open the chart page →

5,604
vehicle-dashboardtest-vehi-dash0.1.01 of 7See more

vehicle-dashboard test-vehi-dash 0.1.0

1 of the 7 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
samajh/alprbackend:latestea742b4372ad
multer@1.4.4
2.3.0

Open the chart page →

20,270
node-redth0ths-helm-charts0.2.11 of 2See more

node-red th0ths-helm-charts 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
th0th/node-red:4.0.3-debiand06fa39f7406
multer@1.4.5-lts.1
2.3.0

Open the chart page →

2,408
thanhvt27-lab-k8sthanh-vtVerified publisher0.1.41 of 5See more

thanhvt27-lab-k8s thanh-vt 0.1.4

1 of the 5 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
redis/redisinsight:latestb5e19ee240ab
multer@2.0.2
2.3.0

Open the chart page →

4,661
node-redthl-chartsVerified publisher0.1.01 of 1See more

node-red thl-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
nodered/node-red:3.0.2-18e2632a7a35dd
multer@1.4.5-lts.1
2.3.0

Open the chart page →

2,806
tfy-distributortruefoundryVerified publisher0.0.11 of 4See more

tfy-distributor truefoundry 0.0.1

1 of the 4 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
multer@1.4.4-lts.1
2.3.0

Open the chart page →

17,323
twentytwenty-crm0.1.111 of 4See more

twenty twenty-crm 0.1.11

1 of the 4 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
twentycrm/twenty:v2.22.0e7d9948bf284
multer@2.2.0
2.3.0

Open the chart page →

5,550
excalidashunxwaresVerified publisher2026.2.51 of 2See more

excalidash unxwares 2026.2.5

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
zimengxiong/excalidash-backend:0.4.271273af713c91
multer@2.0.2
2.3.0

Open the chart page →

2,620
evolution-apivcnngrVerified publisher1.0.01 of 5See more

evolution-api vcnngr 1.0.0

1 of the 5 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
evoapicloud/evolution-api:latest966625532d90
multer@2.0.2
2.3.0

Open the chart page →

3,746
simple-prima-notavcnngrVerified publisher0.5.31 of 4See more

simple-prima-nota vcnngr 0.5.3

1 of the 4 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
vcnngr/pnbackend:latesteaf44ad0ad1f
multer@1.4.5-lts.2
2.3.0

Open the chart page →

4,768
devportalveecode-platform-nextVerified publisher0.1.211 of 1See more

devportal veecode-platform-next 0.1.21

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinnedc443520aebf7
multer@2.2.0
2.3.0

Open the chart page →

1,787
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
multer@2.0.1
2.3.0

Open the chart page →

5,984
wikiwikijs3.0.01 of 2See more

wiki wikijs 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
requarks/wiki:268f0d1848261
multer@1.4.4
2.3.0

Open the chart page →

5,459
workadventureworkadventure1.1.02 of 9See more

workadventure workadventure 1.1.0

2 of the 9 container images this version deploys carry CVE-2026-77063.

Container imageDigestPackageFixed in
thecodingmachine/workadventure-map-storage:v1.17.75bdab56da2fa
multer@1.4.5-lts.1
2.3.0
thecodingmachine/workadventure-uploader:v1.17.73ccd467543b3
multer@1.4.5-lts.1
2.3.0

Open the chart page →

16,083

Container images carrying it

138 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/bryopsida/patchwork:mainc01e018bced4
multer@2.0.1
2.3.0
1
ghcr.io/buanet/iobroker:v9.1.2ca7dc7362968
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/ctron/streamsheets-gateway:2.4.00635f17c9d2c
multer@1.4.2
2.3.0
1
ghcr.io/ctron/streamsheets-service-graphs:2.4.0e34964e336c1
multer@0.1.8
2.3.0
1
ghcr.io/ctron/streamsheets-service-machines:2.4.00c5a3398d1e4
multer@1.4.2
2.3.0
1
ghcr.io/ctron/streamsheets-service-streams:2.4.08ba040e79ca0
multer@1.4.2
2.3.0
1
ghcr.io/danny-avila/librechat:v0.7.87fe76551a78e
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/danny-avila/librechat:v0.7.78c68abbe1cff
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/data-fair/data-fair:3cc9498b64b5b
multer@1.4.4
2.3.0
1
ghcr.io/data-fair/portals:18b621866ceb2
multer@1.4.4
2.3.0
1
ghcr.io/data-fair/simple-directory:438a4f32fad82
multer@1.4.4
2.3.0
1
ghcr.io/fallenbagel/jellyseerr:2.5.22a611369ad1d
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/immich-app/immich-server:v3.2.0ae13784ffcfc
multer@2.2.0
2.3.0
1
ghcr.io/immich-app/immich-server:v3.1.0b434cb9287ee
multer@2.2.0
2.3.0
1
ghcr.io/immich-app/immich-server:v2.3.1f8d06a32b1b2
multer@2.0.2
2.3.0
1
ghcr.io/jordan-dalby/bytestash:1.5.12eb4f736b8cd4
multer@1.4.5-lts.2
2.3.0
1
ghcr.io/lerentis/bitwarden-crd-operator:0.17.00a608c6ead85
multer@1.4.5-lts.2
2.3.0
1
ghcr.io/linuxserver/wikijs:version-2.5.20158d377933678
multer@1.4.2
2.3.0
1
ghcr.io/m9sweeper/dash:1.6.02e27cdff8344
multer@1.4.4-lts.1
2.3.0
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
multer@1.4.5-lts.2
2.3.0
1
ghcr.io/mcwarman/backstage-sample-app/backend:main07aba09a594f
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/rodg/nodecg-base:latest31be4bf87070
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/sct/overseerr:1.26.1254d16af8f71
multer@1.4.2
2.3.0
1
ghcr.io/sct/overseerr:1.35.06197516c9d7b
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/seerr-team/seerr:v3.2.0c4cbd5121236
multer@1.4.5-lts.1
2.3.0
1
ghcr.io/solucteam/outscale-s3-explorer:v1.0.09665c3e71889
multer@1.4.5-lts.2
2.3.0
1
ghcr.io/sredevopsorg/ghost-on-kubernetes:maindd991bafa85e
multer@2.2.0
2.3.0
1
ghcr.io/toeverything/affine:0.27.4b649f5ce2384
multer@2.2.0
2.3.0
1
ghcr.io/woodenmaiden/relfinderreformedapi:1.1.20708d30433d4
multer@1.4.4-lts.1
2.3.0
1
public.ecr.aws/aws-containers/retail-store-sample-checkout:1.3.0687aa68dd490
multer@2.0.1
2.3.0
1
public.ecr.aws/jtekt-corporation/image-storage-service:v1.16.17b1493760c716
multer@1.4.5-lts.1
2.3.0
1
public.ecr.aws/truefoundrycloud/async-service-distributor:5d48113bc678d694a0c8f8dabb2207c5aa2cfc53f74851ce31f5
multer@1.4.4-lts.1
2.3.0
1
quay.io/rhdh/rhdh-hub-rhel9:latest0b26358f5793
multer@2.2.0
2.3.0
1
quay.io/seamware/onboarding:0.2.2b406475f9f00
multer@2.0.2
2.3.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
multer@2.1.1
2.3.0
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
multer@2.1.1
2.3.0
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-events:prod470da8f8730c
multer@2.2.0
2.3.0
1
registry.gitlab.com/prisme.ai/prisme.ai/prisme.ai-runtime:prodbce6d452ad08
multer@2.2.0
2.3.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.