Executive brief
Multer is a popular Node.js library for handling file uploads in web applications. An attacker can crash the application server by sending a specially crafted malformed request that triggers an unhandled exception, causing service outages and disrupting legitimate users' ability to upload files or access the application.
Technical details
This vulnerability is an uncaught exception flaw (CWE-248) affecting Multer versions 1.4.4-lts.1 through 2.0.1. An attacker can send a malformed request to an endpoint using Multer for file upload processing, causing the library to throw an unhandled exception that crashes the Node.js process. The attack requires only network access and no authentication or user interaction. The vulnerability has been patched in version 2.0.2, and users are advised to upgrade immediately.
Affected products
- Express.js Foundation Multer >=1.4.4-lts.1, <2.0.2
Timeline
- 2025-07-17: disclosed: Vulnerability published on GitHub Security Advisory
- 2025-07-17: patched: Version 2.0.2 released with fix