[GHSA] GHSA-qvfw-j98x-7q72 (low) — multer vulnerable to file size limit bypass via async fileFilter race condition

GHSA-qvfw-j98x-7q72 Severity: low CVE: CVE-2026-77063

multer vulnerable to file size limit bypass via async fileFilter race condition

### Impact

When `multer` is configured with an asynchronous `fileFilter`, the `limits.fileSize` limit can be bypassed. The `'limit'` event is registered inside the async `fileFilter` callback, so if a file exceeds `limits.fileSize` before that callback runs, the