[Git][security-tracker-team/security-tracker][master] Associate CVE-2026-113872 with node-multer

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e1e23484 by Salvatore Bonaccorso at 2026-11-02T16:59:01+01:00
Associate CVE-2026-113872 with node-multer

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -12894,7 +12894,8 @@ CVE-2026-113874 (SmileCDR HAPI FHIR allows an untrusted bundle body to replace a
 CVE-2026-113873 (SmileCDR HAPI FHIR does not properly handle highly compressed data, al ...)
 	NOT-FOR-US: SmileCDR
 CVE-2026-113872 (multer is a middleware for Node.js that handles multipart/form-data fi ...)
-	NOT-FOR-US: Node multer
+	- node-multer 2.5.0+~cs3.3.0-1
+	NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-q7qp-rjg7-q26m
 CVE-2026-113582 (UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity  ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-113501 (The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1e234844149b61ae46e456be12264e182728730

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1e234844149b61ae46e456be12264e182728730
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/3a23de9c/attachment-0001.htm>