Ajax File Upload
AJAX file upload sends files via the XMLHttpRequest Level 2 `upload` property or Fetch+FormData without a full page reload (MDN: XMLHttpRequest_API, Using_FormData_Objects). Five libraries dominate 2026 implementation choice: Uppy 5.2.4 (npm, published ~4 months ago; MIT; backed by Transloadit; 30.8k GitHub stars; ~45KB gzip core, 200KB+ with full Dashboard; true resumable uploads via @uppy/tus wrapping tus-js-client). FilePond 4.32.12 (maintainer PQINA; MIT core + paid premium plugins; 16.4k stars; ~270K weekly npm downloads; no built-in resumable protocol). Dropzone.js (18.4k stars; ~600K weekly downloads; last npm publish ~4.5 years ago; MIT; built-in proprietary chunking via `chunking:true`, not tus-standard). jQuery File Upload (blueimp): GitHub-archived April 8, 2026; patched CVE-2018-9206 (CVSS 9.8 unauthenticated arbitrary file upload). Fine Uploader: deprecated since 2018. Maintained by No single owner — implemented via WHATWG XMLHttpRequest/Fetch specs; the library layer (Uppy, FilePond, Dropzone) is maintained separately per-project.
Skip jQuery File Upload and Fine Uploader outright — one's GitHub-archived since April 2026 carrying a patched CVSS-9.8 arbitrary-upload CVE, the other's been dead since 2018. Want a plain drag-and-drop zone with previews and nothing else? Dropzone.js still does that job, but its npm hasn't shipped in over four years — treat it as legacy, not new-build material. Need uploads that survive a dropped connection? Uppy's @uppy/tus is the only one of these five built on the actual tus resumable standard rather than a bespoke chunk format; the full Dashboard build blows past 200KB gzipped, so tree-shake it or you're shipping an uploader heavier than half your app. Known weakness: None of the surviving libraries agree on a resumable-upload protocol — only Uppy's @uppy/tus uses the standard tus protocol, so switching from Dropzone's or FilePond's chunking scheme later means rewriting resumable-upload logic from scratch.