Express 5 + Multer 2 file uploads with limits: working versions (tested 2026-10-15)

{
  "name": "express-multer-upload",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "multer": "2.4.0"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "supertest": "7.3.1",
    "@types/supertest": "7.2.1",
    "@types/express": "5.0.6",
    "@types/multer": "2.3.0"
  }
}

import express, { type NextFunction, type Request, type Response } from "express";
import multer from "multer";

const upload = multer({
  storage: multer.memoryStorage(),
  limits: { fileSize: 1024 * 1024 }, // 1 MB
  fileFilter: (_req, file, cb) => cb(null, ["image/png", "image/jpeg"].includes(file.mimetype)),
});

export function createApp() {
  const app = express();
  app.post("/avatar", upload.single("avatar"), (req, res) => {
    if (!req.file) return res.status(400).json({ error: "png_or_jpeg_required" });
    res.status(201).json({ name: req.file.originalname, size: req.file.size, type: req.file.mimetype });
  });
  app.use((err: unknown, _req: Request, res: Response, _next: NextFunction) => {
    if (err instanceof multer.MulterError) return res.status(err.code === "LIMIT_FILE_SIZE" ? 413 : 400).json({ error: err.code });
    res.status(500).json({ error: "internal" });
  });
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import request from "supertest";
import { createApp } from "../src/app.ts";

test("accepts a small png", async () => {
  const res = await request(createApp()).post("/avatar").attach("avatar", Buffer.from("fakepng"), { filename: "a.png", contentType: "image/png" });
  assert.equal(res.status, 201);
  assert.equal(res.body.size, 7);
});

test("rejects the wrong type", async () => {
  const res = await request(createApp()).post("/avatar").attach("avatar", Buffer.from("hi"), { filename: "a.txt", contentType: "text/plain" });
  assert.equal(res.status, 400);
});

test("rejects files over the limit with 413", async () => {
  const res = await request(createApp()).post("/avatar").attach("avatar", Buffer.alloc(1024 * 1024 + 1), { filename: "big.png", contentType: "image/png" });
  assert.equal(res.status, 413);
  assert.equal(res.body.error, "LIMIT_FILE_SIZE");
});