Is CVE-2025-47935 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-47935 being exploited in the wild.

How severe is CVE-2025-47935?

Low severity, with a CVSS score of 3.1, published 19 May 2025.

Which products and versions are affected?

multer (npm) SEMVER:introduced=0,fixed=2.0.0.

Is there a fix for CVE-2025-47935?

Yes. multer (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-47935 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-47935?

Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-47935: Multer memory leak denial of service via unclosed streams

CVE-2025-47935 · Severity: low · CVSS 3.1 · Published 2025-05-19

Multer is a widely-used Node.js middleware that handles file uploads in web applications. Versions before 2.0.0 fail to properly close internal data streams when HTTP request errors occur, causing accumulated memory and file descriptor leaks. Attackers can trigger repeated request failures to exhaust server resources, leading to denial of service and requiring manual server restarts to recover.

Technologies: multer (npm). Vendors: npm.

Quick answers

Is CVE-2025-47935 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-47935 being exploited in the wild.
How severe is CVE-2025-47935?: Low severity, with a CVSS score of 3.1, published 19 May 2025.
Which products and versions are affected?: multer (npm) SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2025-47935?: Yes. multer (npm): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-47935 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-47935?: Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.0.0 or later
```
npm install multer@2.0.0
```

Technical details

The vulnerability is a resource leak (CWE-401) in Multer's stream handling logic. When an HTTP request stream encounters an error, the internal busboy stream—which handles multipart/form-data parsing—is not explicitly closed, leaving it in an undrained state and violating Node.js stream safety best practices. This causes file descriptors and memory to accumulate with each failed request. An attacker can trigger repeated HTTP request failures (e.g., by aborting uploads or sending malformed multipart data) to trigger the leak repeatedly. Under sustained attack, the server exhausts file descriptors and memory, causing denial of service until manual restart. The vulnerability affects all versions before 2.0.0. Patches are available in version 2.0.0, which implements proper stream draining and explicit error handling for both busboy and request error events.

Affected products

Express.js Multer <2.0.0

Identifiers

CVE-2025-47935
GHSA-44fp-w29j-9vj5

Timeline

2025-05-19: disclosed: Published as GHSA-44fp-w29j-9vj5 and CVE-2025-47935
2025-05-19: patched: Fixed in version 2.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.