anacronw/multer-s3

The package uses a vulnerable version of file-type

Christian-Toney opened this issue · 3 comments

Christian-Toney commented

#185 could fix it, but will that break anything?

orangeiris commented

I'm having 2 moderate severity vulnerabilities because of this

kitman20022002 commented

Same here

jbinto commented

Upgrading file-type (e.g. through yarn resolutions) will not work, the API was changed to be async in 13.x, and since multer-s3 is heavily stream/callback based that's not a drop-in or trivial change.

That being said, I looked through the multer-s3 code. Default installations are not affected by the file-type vulnerability, unless your installation is opting into the AUTO_CONTENT_TYPE constant. That is the only place in the library where file-type is called.

  • 👍1