With multer, you can basically allow/expect one, multiple, none or any attachments.

When you send an attachment to an endpoint that doesn’t accept one, you get the cryptic error message: “MulterError: Unexpected field”.

Wondering if there is a critical problem and checking all my form fields for possible illegal characters, changing field names, etc, it turns out an attachment was sent but not expected.

I think the error message should be: Unexpected Attachment or Attachment Forbidden.

---

Reproduce

App

Exposed over serveo for testing purposes.

const express = require('express')
const bodyParser = require('body-parser')
const multer = require('multer')
const upload = multer({ dest: 'uploads/' })
const app = express()
const port = 3000

app.use(bodyParser.json())
app.use(bodyParser.urlencoded({ extended: true }))

app.get('/', (req, res) => res.send('Hello World!'))

app.post('/', upload.none(), (req, res) => {
	console.log('Incoming POST')
	console.log(JSON.stringify(req.body))
	res.send('Gotcha, thank you.')
})

app.listen(port, () => console.log(`Example app listening on port ${port}!`))

Mailgun

Sending a test request with this button

Error

MulterError: Unexpected field
    at wrappedFileFilter (/var/www/mailguntest/node_modules/multer/index.js:40:19)
    at Busboy.<anonymous> (/var/www/mailguntest/node_modules/multer/lib/make-middleware.js:114:7)
    at Busboy.emit (events.js:210:5)
    at Busboy.emit (/var/www/mailguntest/node_modules/busboy/lib/main.js:38:33)
    at PartStream.<anonymous> (/var/www/mailguntest/node_modules/busboy/lib/types/multipart.js:213:13)
    at PartStream.emit (events.js:210:5)
    at HeaderParser.<anonymous> (/var/www/mailguntest/node_modules/dicer/lib/Dicer.js:51:16)
    at HeaderParser.emit (events.js:210:5)
    at HeaderParser._finish (/var/www/mailguntest/node_modules/dicer/lib/HeaderParser.js:68:8)
    at SBMH.<anonymous> (/var/www/mailguntest/node_modules/dicer/lib/HeaderParser.js:40:12)

https://github.com/expressjs/multer/blob/805170c61530e1f1cafd818c9b63d16a9dd46c36/index.js#L38-L45

{
  encoding: "7bit",
  fieldname: "attachment-1",
  mimetype: "image/gif",
  originalname: "crabby.gif"
}

Alternatively the request just continue with the decoded form parameters, ignoring the unexpected attachments.