# CVE-2025-7338: Multer denial of service via unhandled exception

Source: https://junglewise.ai/threats/cve-2025-7338-multer-denial-of-service-via-unhandled-exception  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-07-17. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-7338 · Severity: low · CVSS 3.1 · Published 2025-07-17

Multer is a popular Node.js library for handling file uploads in web applications. An attacker can crash the application server by sending a specially crafted malformed request that triggers an unhandled exception, causing service outages and disrupting legitimate users' ability to upload files or access the application.

Technologies: [multer (npm)](https://junglewise.ai/threats/technologies/npm-multer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-7338 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-7338 being exploited in the wild.

**How severe is CVE-2025-7338?** Low severity, with a CVSS score of 3.1, published 17 July 2025.

**Which products and versions are affected?** multer (npm) SEMVER:introduced=1.4.4-lts.1,fixed=2.0.2.

**Is there a fix for CVE-2025-7338?** Yes. multer (npm): upgrade to 2.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-7338 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-7338?** Check whether you run multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- multer (npm): upgrade to 2.0.2 or later

  ```sh
  npm install multer@2.0.2
  ```


## Technical details

This vulnerability is an uncaught exception flaw (CWE-248) affecting Multer versions 1.4.4-lts.1 through 2.0.1. An attacker can send a malformed request to an endpoint using Multer for file upload processing, causing the library to throw an unhandled exception that crashes the Node.js process. The attack requires only network access and no authentication or user interaction. The vulnerability has been patched in version 2.0.2, and users are advised to upgrade immediately.

## Affected products

- Express.js Foundation Multer >=1.4.4-lts.1, <2.0.2

## Identifiers

- CVE-2025-7338
- GHSA-fjgf-rc76-4x9p

## Timeline

- 2025-07-17: disclosed: Vulnerability published on GitHub Security Advisory
- 2025-07-17: patched: Version 2.0.2 released with fix

## References

- [https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p](https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p)

## Related threats

- [multer denial of service in asynchronous fileFilter after request teardown](https://junglewise.ai/threats/cve-2026-113872-multer-is-a-middleware-for-node-js-that-handles-multipart-form)
- [Express multer Denial of Service via orphaned disk writes](https://junglewise.ai/threats/cve-2026-88932-express-multer-denial-of-service-via-orphaned-disk-writes)
- [multer denial of service via oversized array index](https://junglewise.ai/threats/cve-2026-82333-multer-denial-of-service-via-oversized-array-index-in-field-names)
- [multer Denial of Service via crafted multipart field names](https://junglewise.ai/threats/cve-2026-77078-multer-denial-of-service-via-crafted-multipart-field-names)
- [multer file size limit bypass via async fileFilter race condition](https://junglewise.ai/threats/cve-2026-77063-multer-file-size-limit-bypass-via-async-filefilter-race-condition)