Safeguard
Tag

file-upload

Safeguard articles tagged "file-upload" — guides, analysis, and best practices for software supply chain and application security.

7 articles

Application Security

Preventing path traversal in Node.js file upload and serving code

path.join() doesn't stop ../../etc/passwd — CVE-2024-12905 and Zip Slip show why Node.js needs explicit containment checks, not just path normalization.

Jul 14, 20266 min read
Security

browser-image-compression: Is Client-Side Image Compression Safe?

browser-image-compression shrinks images in the browser before upload. Here is how it works, its security trade-offs, and why client-side compression is never validation.

Oct 11, 20256 min read
Security

CVE-2023-42794: The Apache Tomcat Incomplete Cleanup DoS Explained

An unreleased refactoring in Tomcat's bundled Commons FileUpload left temp files undeleted on Windows, risking a disk-exhaustion DoS. Here is what CVE-2023-42794 is and how to fix it.

Oct 2, 20255 min read
Open Source

Multer on npm: Security Review and the 2025 DoS Fixes

Multer had a run of denial-of-service advisories through 2025. Here is what each one was, which version fixes them, and how to use the npm package safely.

Aug 20, 20256 min read
Open Source

Formidable npm: Security Review and Safe Usage of the File-Upload Parser

A security review of the formidable npm package: the file-upload risks, the CVEs assigned against it, and how to configure it so uploads stay safe.

Aug 5, 20255 min read
Open Source

Is the Busboy npm Package Safe? A Security Review

The busboy npm package parses multipart form data in Node.js. Here is its current security status, the dicer history that once bit it, and how to use it safely.

May 27, 20255 min read
Web Security

File Upload Vulnerability Prevention: A Practical Guide

File upload functionality is one of the most dangerous features in web applications. This guide covers the attack vectors, bypass techniques, and layered defenses needed to handle file uploads securely.

May 5, 20227 min read

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.

file-upload — Safeguard Blog