[Snyk] Fix for 5 vulnerabilities

[petersem]

Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• package.json
• package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Uncontrolled Recursion SNYK-JS-MULTER-17342512	****
	Prototype Pollution SNYK-JS-AXIOS-15252993	796
	Insertion of Sensitive Information Into Sent Data SNYK-JS-AXIOS-17172681	796
	HTTP Response Splitting SNYK-JS-AXIOS-16298058	776
	Uncontrolled Recursion SNYK-JS-AXIOS-16299923	756

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution
🦉 Uncontrolled Recursion

[petersem]

This update includes two packages. The axios upgrade is rated as medium risk due to a security-driven breaking change, while multer is a low-risk security update.

axios 0.27.2 → 0.32.0

Risk: Medium

This upgrade spans several versions that primarily backport security fixes from the 1.x branch. The key changes address vulnerabilities like prototype pollution, Server-Side Request Forgery (SSRF), and credential leakage.

Breaking Change:
To fix a critical prototype pollution vulnerability, versions from 0.30.3 onwards restrict how configuration objects are merged. Specifically, Axios will no longer merge configurations that target an object's prototype. While this is a necessary security hardening measure, it is a breaking change for any application that might have been using unconventional deep-merging patterns.

Recommendation:
Review any custom Axios configuration merging logic to ensure it does not rely on modifying object prototypes. Most applications will not be affected, but verification is recommended.

multer 2.1.1 → 2.2.0

Risk: Low

This is a minor security update that patches two denial-of-service (DoS) vulnerabilities:

• CVE-2026-5079 (High): Prevents a DoS attack from deeply nested field names in multipart form data.
• CVE-2026-5038 (Medium): Fixes incomplete cleanup of aborted file uploads that could lead to disk exhaustion.

There are no breaking API changes in this version. The upgrade is recommended to improve security.

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.