formidable
Node.js library for parsing form data and file uploads. Handles multipart/form-data and application/x-www-form-urlencoded request bodies, writing uploaded files to disk or keeping in memory. Supports progress events, file size limits, file type validation, and streaming. The standard solution for file upload handling in Express.js applications alongside multer.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
File upload handling is security-critical. Always validate file types and sizes. Temp files must be managed. MIT licensed. HTTPS required for production file uploads. Sanitize original filenames before storing.
⚡ Reliability
Best When
You need flexible file upload handling with streaming, progress events, and configuration options for an Express.js application.
Avoid When
You only need simple single-file uploads with minimal configuration — multer provides a simpler API with less configuration.
Use Cases
- • Handle file uploads in Express.js agent API endpoints with configurable upload directory and size limits
- • Parse multipart form submissions with both text fields and file attachments in agent web services
- • Stream large file uploads to cloud storage without holding entire file in memory
- • Implement file type validation and size restriction for secure agent document upload APIs
- • Process multi-file uploads in batch document processing agent workflows
Not For
- • Simple JSON body parsing — use express.json() middleware for JSON API request bodies
- • GraphQL file uploads — use graphql-upload which wraps multer for GraphQL multipart spec
- • High-concurrency file uploads with streaming to S3 — busboy (used by multer) may be more performant for pure streaming scenarios
Interface
Authentication
Local library — no authentication required. MIT licensed.
Pricing
MIT licensed. Zero cost.
Agent Metadata
Known Gotchas
- ⚠ Must set maxFileSize option to prevent DoS from large uploads: new formidable.IncomingForm({ maxFileSize: 10 * 1024 * 1024 }) — default is 200MB which is dangerously large
- ⚠ Uploaded files are temporary by default — written to OS temp directory and must be moved or read before response ends; temp files are automatically cleaned up
- ⚠ v3 has breaking API changes from v2 — form.parse() now returns a Promise; v2-style callbacks may need migration
- ⚠ File type validation is NOT built-in — validate file.mimetype and file.originalFilename in your handler; formidable accepts any file type by default
- ⚠ Multiple files with same field name: use fields and files destructuring: const [fields, files] = await form.parse(req) — files[fieldname] is an array
- ⚠ For large files, implement the 'progress' event to track upload progress: form.on('progress', (bytesReceived, bytesExpected) => {})
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for formidable.
Scores are editorial opinions as of 2026-03-06.