Cloudanix VulnDB

CVE-2026-113872

High · 7.5

CVSS

7.5

EPSS

0.4%

Published

Oct 22, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in a popular Node.js file-upload component lets an attacker crash the server by starting an upload and then quickly canceling it, causing downtime for any site that accepts file uploads.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

When an asynchronous fileFilter callback is pending and the client aborts the request, multer tears down the parser but the later callback resumes a destroyed stream, causing the underlying parser to emit an error on a stream with no listeners and triggering an uncaughtException that terminates the Node.js process.

Why it matters to the business

Applications using multer with async file filters can be crashed by a single unauthenticated request, producing denial of service that disrupts file-upload services and requires process restarts.

How an attack unfolds

An attacker crafts a multipart/form-data POST containing one or more files, configures the connection so the request is aborted after the async fileFilter is invoked but before it completes, and the resulting unhandled error event terminates the worker process.

How to fix it

Upgrade multer to version 2.5.0 or later. As a temporary mitigation, replace any asynchronous fileFilter logic with a synchronous implementation.

How to confirm the fix worked

After upgrade, confirm package.json or package-lock.json shows multer >= 2.5.0, then exercise endpoints that previously used async filters while monitoring for uncaughtException events and process restarts.

Typical attack path

  1. Identify an endpoint that uses multer with an asynchronous fileFilter
  2. Send a multipart POST with file parts and immediately close the connection before the filter callback returns
  3. Observe the Node.js process exit due to the uncaught error event

How to detect it

Search Node.js application logs and process monitors for unexpected exits accompanied by error events originating from the multipart parser shortly after an aborted upload request; correlate with web-server access logs showing incomplete multipart POSTs to multer endpoints.

What your security team should do

  • Immediately inventory all services using multer and identify those with async fileFilter usage
  • Upgrade to multer 2.5.0+ in the next maintenance window
  • Temporarily switch to synchronous fileFilter implementations where upgrade cannot occur quickly
  • Add monitoring for Node.js uncaughtException and worker restarts on upload-handling services

The record

multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities