AIKIDO-2026-40862

TL;DR

When multer is configured with an asynchronous fileFilter, the handler that enforces limits.fileSize is registered inside the async callback. A file that exceeds the configured size limit before the callback runs slips through the timing window, so the size-limit event never fires and the oversized file is accepted and written. This affects all upload methods when an async filter is used, while synchronous filters remain unaffected. The fix enforces the file-size limit independently of the asynchronous filter timing.