Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Express August 2026 security releases: hbs, multer, and morgan
- Security
- Course
Instructor-curated digest, not original reporting. Each post paraphrases a public article and links to the original source.
On August 31, 2026, Ulises Gascon published August 2026 security releases on the Express blog. The releases are hbs 4.3.0, multer 2.3.0, and morgan 1.12.0, addressing six vulnerabilities.
The post names CVE-2026-16231 (hbs async helper XSS, High); CVE-2026-77037, CVE-2026-77078, and CVE-2026-82333 (multer denial-of-service and resource issues, High); CVE-2026-15603 (morgan Unicode log forging, Medium); and CVE-2026-77063 (multer async fileFilter size-limit bypass, Low). The recommended action is to upgrade with npm update hbs multer morgan, or bump those packages. Multipart upload middleware and request logging fit the Node dependency hygiene in Chapter 5; follow the original Express post for the full CVE list and upgrade notes.
Read original: August 2026 Security Releases — Express.js
Related in the book: Chapter 5