Multer

Multer is the de facto standard middleware for handling multipart/form-data in Node.js, most commonly used to accept file uploads in Express applications. Built on top of busboy for streaming performance, it parses incoming multipart requests and attaches parsed text fields to req.body and uploaded files to req.file or req.files, with pluggable storage engines for writing to disk or buffering in memory.

With over 12,000 GitHub stars and tens of millions of weekly npm downloads, Multer has become the default choice any time a Node.js backend needs to accept uploaded files — profile pictures, documents, CSV imports, or attachments — without hand-rolling a multipart parser.

What You Get

• Drop-in Express/Connect middleware for parsing multipart/form-data requests
• Built-in DiskStorage and MemoryStorage engines, plus a documented StorageEngine interface for custom storage (S3, GCS, databases)
• Field-level upload strategies via .single(), .array(), .fields(), .any(), and .none()
• Configurable limits (file size, file count, field count, part count) to guard against DoS uploads
• Typed MulterError codes for granular error handling

Common Use Cases

• Accepting profile picture or avatar uploads in a REST API
• Handling document/CSV/PDF attachment uploads alongside form text fields
• Building admin dashboards or CMS backends that accept bulk file uploads
• Streaming uploaded files directly into custom storage backends (S3-compatible object storage) via a custom StorageEngine

Under The Hood

Architecture: Multer’s architecture centers on a factory pattern: the exported multer() function (index.js) constructs a Multer instance holding shared config (storage engine, limits, fileFilter), and instance methods like .single(), .array(), .fields(), .none(), .any() each call _makeMiddleware() to produce an Express-compatible (req, res, next) handler via lib/make-middleware.js. That core middleware wires a busboy parser to the request stream, using a Counter (lib/counter.js, an EventEmitter-based pending-writes counter) to track in-flight file writes and a FileAppender (lib/file-appender.js) that abstracts the three request-shape strategies (VALUE/ARRAY/OBJECT/NONE) for attaching parsed files to req.file/req.files. Storage is delegated to a pluggable StorageEngine interface (storage/disk.js, storage/memory.js) implementing _handleFile/_removeFile, and any failed or aborted upload triggers remove-uploaded-files.js to clean up partially-written files before calling next(err) with a MulterError.

Tech Stack: The library is plain CommonJS JavaScript (no build step, no TypeScript — 100% JS per GitHub language stats) targeting Node >= 10.16.0. Runtime dependencies are minimal and purpose-built: busboy (the actual multipart stream parser Multer wraps), type-is (content-type sniffing to short-circuit non-multipart requests), append-field (nested/bracket-notation form field parsing), and concat-stream. Dev tooling uses standard for linting/formatting (no ESLint/Prettier config), mocha + nyc for tests and coverage, and express/form-data/fs-temp/testdata-w3c-json-form as test fixtures. CI (.github/workflows/ci.yml) runs the full mocha suite across 17 Node.js versions (10.x through 26.x), reflecting a strong backward-compatibility commitment for an Express-ecosystem package.

Code Quality: Test coverage is substantial: 19 spec files under test/ totaling ~2,484 lines covering disk/memory storage, field/file limits, error handling, Express integration, Unicode filenames, nesting depth, and orphaned-file cleanup — run via mocha --check-leaks with nyc coverage reporting to Coveralls in CI. Code style is consistent (var-based ES5-leaning style enforced by standard), functions are small and single-purpose, and error paths are explicit via a dedicated MulterError type with a fixed errorMessages map (lib/multer-error.js) rather than generic thrown errors. Edge-case handling is notably careful — make-middleware.js guards against double-invoking next(), drains the request stream on error to avoid EPIPE, and listens for aborted/close to avoid hangs on client disconnects — the kind of defensive stream handling expected of infrastructure-grade middleware maintained by the Express org.

API Design: Multer’s public API is deliberately narrow and mirrors Express’s own middleware conventions, minimizing the learning curve: multer(opts).single/array/fields/any/none() returns a standard (req, res, next) middleware with no unusual invocation pattern. The dest shorthand covers the common case in one line, while storage unlocks full control via a documented (StorageEngine.md) three-function interface (_handleFile, _removeFile, plus a constructor) that third-party packages (multer-s3, multer-gridfs-storage, etc.) implement. Trade-offs: there’s no bundled TypeScript definitions (community-maintained via @types/multer on DefinitelyTyped), and file objects are loosely-typed plain objects assembled by string-keyed Object.defineProperty/spread rather than a class, which keeps things flexible but offers no compile-time safety without external types.