Executive brief
Multer is a widely-used Node.js middleware that handles file uploads in web applications. Versions before 2.0.0 fail to properly close internal data streams when HTTP request errors occur, causing accumulated memory and file descriptor leaks. Attackers can trigger repeated request failures to exhaust server resources, leading to denial of service and requiring manual server restarts to recover.
Technical details
The vulnerability is a resource leak (CWE-401) in Multer's stream handling logic. When an HTTP request stream encounters an error, the internal busboy stream—which handles multipart/form-data parsing—is not explicitly closed, leaving it in an undrained state and violating Node.js stream safety best practices. This causes file descriptors and memory to accumulate with each failed request. An attacker can trigger repeated HTTP request failures (e.g., by aborting uploads or sending malformed multipart data) to trigger the leak repeatedly. Under sustained attack, the server exhausts file descriptors and memory, causing denial of service until manual restart. The vulnerability affects all versions before 2.0.0. Patches are available in version 2.0.0, which implements proper stream draining and explicit error handling for both busboy and request error events.
Affected products
- Express.js Multer <2.0.0
Timeline
- 2025-05-19: disclosed: Published as GHSA-44fp-w29j-9vj5 and CVE-2025-47935
- 2025-05-19: patched: Fixed in version 2.0.0