[Git][security-tracker-team/security-tracker][master] Reassociate some NFUs to src:node-multer

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
480ed5e2 by Salvatore Bonaccorso at 2026-11-02T17:08:13+01:00
Reassociate some NFUs to src:node-multer

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -317589,7 +317589,9 @@ CVE-2025-7339 (on-headers is a node.js middleware for listening to when a respon
 	NOTE: https://github.com/jshttp/on-headers/issues/15
 	NOTE: Fixed by: https://github.com/jshttp/on-headers/commit/c6e384908c9c6127d18831d16ab0bd96e1231867 (v1.1.0)
 CVE-2025-7338 (Multer is a node.js middleware for handling `multipart/form-data`. A v ...)
-	NOT-FOR-US: Node multer
+	- node-multer <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p
+	NOTE: Fixed by: https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b (v2.0.2)
 CVE-2025-6813 (The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2025-6781 (The Copymatic \u2013 AI Content Writer & Generator plugin for WordPres ...)
@@ -332232,7 +332234,10 @@ CVE-2025-4138 (Allows the extraction filter to be ignored, allowing symlink targ
 CVE-2025-48998 (DataEase is an open source business intelligence and data visualizatio ...)
 	NOT-FOR-US: DataEase
 CVE-2025-48997 (Multer is a node.js middleware for handling `multipart/form-data`. A v ...)
-	NOT-FOR-US: Node multer
+	- node-multer <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/expressjs/multer/issues/1233
+	NOTE: https://github.com/expressjs/multer/pull/1256
+	NOTE: Fixed by: https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9 (v2.0.1)
 CVE-2025-48953 (Umbraco is an ASP.NET content management system (CMS). Starting in ver ...)
 	NOT-FOR-US: Umbraco CMS
 CVE-2025-48950 (MaxKB is an open-source AI assistant for enterprise. Prior to version  ...)
@@ -335874,9 +335879,15 @@ CVE-2025-47949 (samlify is a Node.js library for SAML single sign-on. A Signatur
 CVE-2025-47946 (Symfony UX is an initiative and set of libraries to integrate JavaScri ...)
 	NOT-FOR-US: symfony/ux
 CVE-2025-47944 (Multer is a node.js middleware for handling `multipart/form-data`. A v ...)
-	NOT-FOR-US: Node multer
+	- node-multer <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h
+	NOTE: https://github.com/expressjs/multer/pull/1120
+	NOTE: Fixed by: https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665 (v2.0.0)
 CVE-2025-47935 (Multer is a node.js middleware for handling `multipart/form-data`. Ver ...)
-	NOT-FOR-US: Node multer
+	- node-multer <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5
+	NOTE: https://github.com/expressjs/multer/pull/1120
+	NOTE: Fixed by: https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665 (v2.0.0)
 CVE-2025-47934 (OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Sta ...)
 	- node-openpgp <itp> (bug #787774)
 CVE-2025-47583 (Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salo ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/480ed5e24929ea5b32afa69f749d0d5dd6821abe

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/480ed5e24929ea5b32afa69f749d0d5dd6821abe
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/8e704a36/attachment.htm>