[ostridm]

7399190
cccf0fe

[sapozhnikovay]

Thanks a lot! 👏

[github-actions]

🎉 This PR is included in version 3.4.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[Copilot]

Pull request overview

Ports upstream security-related fixes to harden multipart parsing against client disconnects and ensure temporary upload files are cleaned up when requests fail.

Changes:

• Track created temp file paths during multipart file handling and attempt cleanup on error.
• Treat req.close (mid-upload disconnect) as a client-abort error to avoid middleware hangs.
• Add regression tests for orphaned temp-file cleanup and disconnect-related hangs.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
lib/read-body.js	Adds temp file tracking/cleanup and rejects parsing when the request closes mid-stream.
test/error-handling.js	Adds tests asserting no temp-file leakage on multipart errors.
test/aborted-requests.js	Adds a regression test to ensure no hang on mid-upload client disconnect via close.

Comments suppressed due to low confidence (5)

lib/read-body.js:240

• Temp file cleanup is started asynchronously and errors are ignored (fs.unlink(..., () => {})). This can race with the caller/test (files may still exist briefly) and can silently fail (e.g., Windows EBUSY), leaving orphaned temp files despite the intended fix. Consider awaiting deletions (e.g., fs.promises.unlink with ENOENT ignored) and/or ensuring the temp path is valid before unlinking.

    // Clean up any temp files that were written but will never be returned to the caller
    for (const tmpPath of tempFiles) {
      fs.unlink(tmpPath, () => {})
    }

test/error-handling.js:83

• This test snapshots the entire OS temp directory (os.tmpdir() + readdirSync) and asserts it doesn’t change. That’s non-deterministic (other tests/processes can create temp files) and can be slow on machines with many temp entries. Prefer using an isolated temp directory for this test (e.g., fs.mkdtemp and pointing the temp-file writer at it) or filtering only files created by this library.

    const tmpDir = os.tmpdir()
    const before = new Set(fs.readdirSync(tmpDir))

test/error-handling.js:121

• Same issue as above: asserting the entire os.tmpdir() listing is unchanged can make the test flaky and slow. Use a per-test temp directory (or filter by this library’s temp-file naming/prefix) so the assertion only covers files created by the test.

    const tmpDir = os.tmpdir()
    const before = new Set(fs.readdirSync(tmpDir))

test/aborted-requests.js:108

• The socket error event is swallowed. If the connection fails (e.g., port bind/connect issues), the server handler won’t run and done() may never be called, leading to a test timeout instead of a clear failure. Handle the error by failing the test (and closing the server) rather than ignoring it.

      sock.on('error', () => {})
    })

lib/read-body.js:60

• The new errorOccured flag is misspelled and reduces readability/consistency with the rest of the file’s camelCase naming. Rename to errorOccurred (and update all references).

  let errorOccured = false

  const rejectOnce = (reject, err) => {
    if (errorOccured) return
    errorOccured = true
    reject(err)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.