CVE-2025-47944

What it actually does

CVE-2025-47944 is a denial-of-service flaw in Multer, a Node.js middleware commonly used with Express applications to process multipart/form-data file uploads. Affected versions starting at 1.4.4-lts.1 and before 2.0.0 can throw an unhandled exception when parsing a malformed multipart upload request. Because the exception is not safely handled by the library, the Node.js process may terminate, making the application unavailable until the process is restarted by a supervisor, container orchestrator, or manual intervention. The impact is availability-only: it does not directly provide code execution, data disclosure, authentication bypass, or data modification.

Why it matters to the business

An unauthenticated remote attacker can crash web services that expose file-upload endpoints using vulnerable Multer versions. For businesses, this can mean application outages, failed uploads, interrupted user workflows, degraded API availability, increased support load, and potential cascading failures if the crashed process is part of a larger service dependency chain. The CVSS score of 7.5 reflects high availability impact, but the current EPSS value is low and it is not listed in CISA KEV, so prioritization should focus on internet-facing upload functionality and critical services rather than assuming active mass exploitation.

How an attack unfolds

An attacker first identifies an HTTP endpoint that accepts multipart/form-data uploads, such as a file upload, image upload, import, attachment, or form submission feature backed by Multer. The attacker then sends a specially malformed multipart request that violates parser expectations in the affected Multer version. When the vulnerable code attempts to parse the request, it triggers an exception path that is not properly handled. In a typical Node.js deployment, an uncaught exception can terminate the worker process. If the application is not supervised, the service remains down; if it is supervised by PM2, systemd, Docker, Kubernetes, or another process manager, the service may restart, allowing repeated requests to cause crash loops and sustained denial of service. No authentication or user interaction is required if the upload endpoint is publicly reachable.

How to fix it

Upgrade Multer to version 2.0.0 or later. For source-based consumers of expressjs/multer, ensure the codebase includes the fix introduced in commit 2c8505f207d923dd8de13a9f93a4563e59933665. Because no known workaround is available, dependency upgrade is the primary remediation. After upgrading, rebuild and redeploy all applications, containers, serverless bundles, and downstream packages that vendor or bundle Multer. Where immediate upgrade is delayed, reduce exposure by restricting access to upload endpoints, enforcing request size limits at the reverse proxy or load balancer, applying rate limits, requiring authentication where appropriate, and ensuring process supervisors restart crashed workers; these measures reduce operational impact but should not be treated as a complete fix.

How to confirm the fix worked

Confirm that dependency manifests and lockfiles resolve Multer to 2.0.0 or later, or that source checkouts contain commit 2c8505f207d923dd8de13a9f93a4563e59933665. Validate with package tooling such as npm ls multer, yarn why multer, pnpm why multer, software composition analysis, and container image scans. Exercise upload endpoints with normal multipart uploads to confirm application functionality after the upgrade. If safe in a non-production environment, send malformed multipart/form-data test cases and verify the application returns a controlled 4xx error or safely closes the request without terminating the Node.js process. Also confirm runtime stability by checking that process restart counters do not increase during malformed-request testing.

Typical attack path

1. Discover an application endpoint that accepts multipart/form-data requests, especially file upload or form submission routes.
2. Confirm the endpoint is reachable without authentication or with low-privilege access.
3. Send a malformed multipart/form-data request designed to trigger the vulnerable Multer parsing path.
4. Cause an unhandled exception in the Node.js process while Multer parses the request.
5. Force the application worker to terminate or restart.
6. Repeat requests to create intermittent outages, crash loops, or sustained denial of service.

How to detect it

To determine whether this vulnerability was already exploited, correlate HTTP access logs with application crash and restart telemetry. Focus on upload endpoints receiving multipart/form-data requests that are malformed, unusually small, missing boundaries, using invalid boundary syntax, abruptly terminated, or producing 400/500 responses immediately before a Node.js worker exits. Review application logs for uncaught exceptions, Multer or multipart parser stack traces, and process termination messages. Review process-manager and runtime sources such as PM2 logs, systemd journal, Docker/Kubernetes container events, serverless execution logs, APM traces, and Node.js stderr for repeated crashes or restart loops. In web server, load balancer, CDN, and WAF logs, look for bursts of POST requests with Content-Type: multipart/form-data targeting upload routes, especially from the same source IP, user agent, ASN, or automation tool, followed by 502/503/504 responses. No public KEV listing, ransomware association, or named threat actor activity is currently indicated for this CVE, so detection should emphasize local crash evidence rather than known actor-specific infrastructure.

• Content-Type: multipart/form-data
• multipart/form-data; boundary=
• Error: Multipart: Boundary not found
• Unexpected end of form
• Unexpected end of multipart data
• MulterError
• uncaughtException
• Unhandled exception
• UnhandledPromiseRejectionWarning
• node:internal/process
• node:internal/streams
• at multer
• /node_modules/multer/
• npm ls multer
• pm2: App [
• exited with code
• systemd: Main process exited
• Back-off restarting failed container
• CrashLoopBackOff
• HTTP 502
• HTTP 503
• HTTP 504

What your security team should do

• Inventory all Node.js and Express applications that use Multer, including transitive, vendored, and bundled copies.
• Prioritize remediation for internet-facing applications, unauthenticated upload endpoints, and services whose outage would affect customer-facing or business-critical workflows.
• Upgrade Multer to 2.0.0 or later and redeploy affected applications; verify lockfiles and container images reflect the fixed version.
• Add or confirm reverse-proxy request controls, including upload size limits, header/body timeouts, and rate limiting for multipart/form-data endpoints.
• Ensure Node.js services are supervised by a process manager or orchestrator with restart limits and alerting for crash loops.
• Monitor application logs, process-manager logs, container events, and web access logs for malformed multipart requests followed by Node.js crashes or restarts.
• Because the vulnerability is not currently in CISA KEV and has low EPSS, treat it as a high-priority availability fix for exposed upload services rather than an emergency exploited-in-the-wild response unless local evidence indicates exploitation.