fix: upgrade multer to 2.2.0, 3.0.0-alpha.2 (CVE-2026-5079)

[anupamme]

Summary

Upgrade multer from 2.1.1 to 2.2.0, 3.0.0-alpha.2 to fix CVE-2026-5079.

Vulnerability

Field	Value
ID	CVE-2026-5079
Severity	HIGH
Scanner	trivy
Rule	CVE-2026-5079
File	backend/package-lock.json (dependency: multer)
Assessment	Likely exploitable

Description: multer: Multer: Denial of Service via deeply nested field names in multipart form data

Evidence

Scanner confirmation: trivy rule CVE-2026-5079 flagged this pattern.

Changes

• backend/package.json
• backend/package-lock.json

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This change addresses a pattern flagged by static analysis. The code path handles user-influenced input and the fix reduces the attack surface against both manual and automated exploitation.

---

Automated security fix by OrbisAI Security

Summary

• Upgraded multer to address high-severity CVE-2026-5079.
• Updated dependency declarations and lockfile entries.
• Prevents denial-of-service attacks through deeply nested multipart field names.

Testing

• Not run. Dependency-only change.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 274a1b8c-bd95-4f06-9d6d-cfc20573a06d

📥 Commits

Reviewing files that changed from the base of the PR and between 90c2e5b and 1e65152.

⛔ Files ignored due to path filters (1)

• backend/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• backend/package.json

---

📝 Walkthrough

Walkthrough

The backend package manifest updates the multer dependency from ^2.0.2 to ^2.2.0.

Changes

Backend dependency update

Layer / File(s)	Summary
Multer version update backend/package.json	Updates the multer dependency from ^2.0.2 to ^2.2.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested labels: ECSoC26-L1, ECSoC26, good-pr

Suggested reviewers: ionfwsrijan, sahare77, karanunique

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Multer upgrades and the CVE addressed by the pull request.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}