Khoury College of Computer Sciences
CS 4550 / CS 5610 · Web Development · Fall 2026
Express August 2026 security releases: hbs, multer, and morgan
- Security
- Course
Instructor-curated digest, not original reporting. Optional further reading — not required for grades.
On August 31, 2026, Ulises Gascon published August 2026 security releases on the Express blog. The releases are hbs 4.3.0, multer 2.3.0, and morgan 1.12.0, addressing six vulnerabilities.
The post names CVE-2026-16231 (hbs async helper XSS, High); CVE-2026-77037, CVE-2026-77078, and CVE-2026-82333 (multer denial-of-service and resource issues, High); CVE-2026-15603 (morgan Unicode log forging, Medium); and CVE-2026-77063 (multer async fileFilter size-limit bypass, Low). The recommended action is to upgrade with npm update hbs multer morgan, or bump those packages. For Chapter 5 Express and Node server hygiene, multipart upload middleware and logging are common lab patterns; patch when advisories land.
Optional further reading for CS 4550 / CS 5610 — not required for labs or grades. This digest is not a substitute for the advisory — follow the original Express post for the full CVE list and upgrade notes.
Read original: August 2026 Security Releases — Express.js
Related in the book: Chapter 5