Multer is the standard middleware for multipart/form-data handling in Express. It processes file uploads and stores them on disk or in memory.
Configure storage: diskStorage for local files, memoryStorage for processing before upload. Set file size limits and type filters to prevent abuse.
Cloud storage options: AWS S3 with @aws-sdk/s3-upload, Cloudinary for image transformation, Google Cloud Storage. Use signed URLs for direct client uploads.
Streaming uploads with busboy handle large files without memory pressure. Process chunks as they arrive.
Security: validate file types by magic numbers, not just extensions. Scan for malware. Store uploads outside the web root. Use random filenames to prevent path traversal.
Progress tracking: use upload events to report progress to the client. Handle resumable uploads with TUS protocol for large files.