CVE-2025-48997

What it actually does

A vulnerability in the Multer middleware for Node.js allows a remote, unauthenticated attacker to cause a Denial of Service (DoS). By sending a specially crafted `multipart/form-data` request containing a field with an empty string for its name, an attacker can trigger an unhandled exception. This exception crashes the entire Node.js process, making the application unavailable.

Why it matters to the business

Exploitation of this vulnerability will lead to application downtime. For any web service that relies on the vulnerable component for file uploads, an attacker can repeatedly crash the service, making it unavailable to legitimate users. This can result in a poor user experience, loss of customer trust, and potential revenue loss, especially for business-critical applications. Since the attack is simple and requires no authentication, any exposed application is at risk of service disruption.

How an attack unfolds

A remote attacker targets a web application that uses a vulnerable version of the Multer library to handle file uploads. The attacker constructs a malicious HTTP POST request with a `multipart/form-data` content type. Within the body of this request, the attacker defines a part with a `Content-Disposition` header where the `name` attribute is an empty string (e.g., `name=""`). When the Node.js application receives this request, the Multer middleware attempts to parse it. It fails to properly handle the empty field name, leading to an unhandled exception that propagates up the stack and terminates the Node.js process, causing an immediate Denial of Service.

How to fix it

The primary and only recommended remediation is to upgrade the Multer package to a patched version. The vulnerability is fixed in version `2.0.1` and later. Developers should update their project's `package.json` file to specify `"multer": "^2.0.1"` or a higher version and then run their package manager's install command (e.g., `npm install` or `yarn install`). According to the vulnerability report, there are no known workarounds.

How to confirm the fix worked

To validate that the vulnerability has been remediated, inspect the project's dependency tree to confirm that the installed version of Multer is `2.0.1` or later. Use commands like `npm list multer` or `yarn list --pattern multer` in the application's root directory. Ensure that the resolved version in `package-lock.json` or `yarn.lock` is a non-vulnerable one. Do not attempt to validate the vulnerability by sending exploit traffic to production systems.

Typical attack path

1. The attacker identifies a target Node.js application that uses the Multer middleware for handling file uploads.
2. The attacker crafts a malicious `multipart/form-data` HTTP request containing a part with an empty string for the `name` attribute in its `Content-Disposition` header.
3. The attacker sends this request to an endpoint on the application that processes file uploads.
4. The vulnerable Multer library receives the request and fails to parse the empty field name, triggering an unhandled exception.
5. The Node.js process crashes, causing the application to become unavailable until it is manually or automatically restarted.

How to detect it

To detect potential exploitation, security teams should monitor for unexpected crashes and restarts of Node.js application processes. Correlate these crash events with inbound traffic in web server or load balancer access logs. Look for HTTP POST requests to file upload endpoints that occurred immediately before a crash. Application performance monitoring (APM) tools or application-level error logs may contain stack traces indicating an unhandled exception originating from the Multer library's form parsing logic.

• http.request.body contains 'Content-Disposition: form-data; name=""'

What your security team should do

• Use software composition analysis (SCA) tools to identify all applications and services that use the `multer` Node.js package.
• Prioritize patching for publicly accessible applications that handle file uploads, as they are the most likely targets.
• Upgrade all instances of `multer` to version `2.0.1` or newer. Since no workarounds exist, patching is critical.
• Consider implementing robust process management (like PM2 or systemd) and automated restarts for Node.js applications to minimize downtime from crashes, though this does not fix the underlying vulnerability.