Is CVE-2026-113872 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-113872 being exploited in the wild.

How severe is CVE-2026-113872?

High severity, with a CVSS score of 7.5, published 22 October 2026.

Which products and versions are affected?

Expressjs Multer 2.0.0 to 2.4.x; multer (npm) >= 2.0.0, < 2.5.0, SEMVER:introduced=2.0.0,fixed=2.5.0.

Is there a fix for CVE-2026-113872?

Yes. multer (npm): upgrade to 2.5.0 or later. Until then: Use a synchronous fileFilter instead of an asynchronous one until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-113872 attacked?

It is attacked over the network.

Am I affected by CVE-2026-113872?

Check whether you run Expressjs Multer or multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113872: multer denial of service in asynchronous fileFilter after request teardown

Q: Is there a fix for CVE-2026-113872?

Yes. multer (npm): upgrade to 2.5.0 or later. Until then: Use a synchronous fileFilter instead of an asynchronous one until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-113872 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-113872?

Check whether you run Expressjs Multer or multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-113872 · Severity: high · CVSS 7.5 · Published 2026-10-22

multer is a Node.js middleware that handles file uploads from web forms. When configured with asynchronous file filtering, a single aborted upload request can crash the entire Node.js process, causing service outages. An attacker needs no authentication and can trigger this with a single malformed request, making this a critical availability risk for any web application using this feature.

Technologies: multer (npm). Vendors: Expressjs, npm.

Quick answers

Is CVE-2026-113872 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-113872 being exploited in the wild.
How severe is CVE-2026-113872?: High severity, with a CVSS score of 7.5, published 22 October 2026.
Which products and versions are affected?: Expressjs Multer 2.0.0 to 2.4.x; multer (npm) >= 2.0.0, < 2.5.0, SEMVER:introduced=2.0.0,fixed=2.5.0.
Is there a fix for CVE-2026-113872?: Yes. multer (npm): upgrade to 2.5.0 or later. Until then: Use a synchronous fileFilter instead of an asynchronous one until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-113872 attacked?: It is attacked over the network.
Am I affected by CVE-2026-113872?: Check whether you run Expressjs Multer or multer (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

multer (npm): upgrade to 2.5.0 or later
```
npm install multer@2.5.0
```

Use a synchronous fileFilter instead of an asynchronous one until upgrading.

Technical details

An unhandled error is emitted on a stream without an error listener when an asynchronous fileFilter callback resumes after request teardown. If a request aborts while an async fileFilter is pending, the callback later resumes parsing on a stream multer has already torn down, causing busboy to emit an uncaught error event that crashes the Node.js process. This affects all applications using async fileFilter regardless of storage engine; synchronous fileFilter is not vulnerable.

Affected products

expressjs multer 2.0.0 to 2.4.x

Identifiers

CVE-2026-113872
GHSA-q7qp-rjg7-q26m

Timeline

2026-10-22: disclosed
2026-10-22: patched: Version 2.5.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.