All vulnerabilities
CVE-2026-113872GHSA-q7qp-rjg7-q26m

multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown

multer multernpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
7.5High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.44%Chance of exploitation activity in the next 30 days, higher than 37% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.5.0Fixed versionGitHub
Published22 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 22 Oct 2026, 14:20 UTCPublishedCVE List
  2. 23 Oct 2026, 01:24 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

Impact

When multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If a request is aborted (for example when one file is rejected) while another file's async fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down. busboy then emits an error on a stream that no longer has an error listener, which Node raises as an unhandled 'error' event, and the process exits. A single unauthenticated request is enough, so any application using multer with an asynchronous fileFilter is affected, regardless of storage engine. Uploads using a synchronous fileFilter are not affected.

Patches

Users should upgrade to multer 2.5.0 or later.

Workarounds

Use a synchronous fileFilter.

Text from GitHub Advisory Database

Affected versions 4

  • multer, npm>= 2.0.0, < 2.5.0GitHub
  • multeraffected: 2.0.0 before 2.5.0CVE List
  • multerunaffected: 2.5.0CVE List
  • multer, npmfrom 2.0.0, fixed in 2.5.0OSV

References 6