Executive brief
Multer is a widely-used Node.js middleware for handling file uploads in web applications. A vulnerability in versions 1.4.4-lts.1 through 1.x allows attackers to crash the application by sending malformed file upload requests, causing service downtime and potential denial of service attacks against any web application using affected versions.
Technical details
The vulnerability is an uncaught exception (CWE-248) in Multer's handling of malformed multipart/form-data upload requests. Specifically, an error event from the underlying busboy stream parser is not properly caught and handled, causing an unhandled exception that crashes the Node.js process. The attack requires only network access and no authentication or special privileges; an attacker can trigger the crash by sending a crafted multipart request with malformed structure. This affects all versions from 1.4.4-lts.1 to <2.0.0. The fix involves explicitly handling busboy error events and properly draining the request stream, which was addressed in version 2.0.0.
Affected products
- expressjs multer >=1.4.4-lts.1, <2.0.0
Timeline
- 2025-05-19: disclosed: GHSA-4pg4-qvpc-4q3h published
- 2025-05-19: patched: Version 2.0.0 released with fix