CVE-2025-47944: Multer vulnerable to Denial of Service from maliciously crafted requests
Impact A vulnerability in Multer versions >=1.4.4-lts.1 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process.
Patches Users should upgrade to 2.0.0
Workarounds None
References
- https://github.com/expressjs/multer/issues/1176 - https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
Other sources
Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47944?
CVE-2025-47944 has been assigned a critical severity due to its potential to cause a Denial of Service (DoS) attack.
How do I fix CVE-2025-47944?
To fix CVE-2025-47944, upgrade Multer to version 2.0.0 or later.
Which versions of Multer are affected by CVE-2025-47944?
CVE-2025-47944 affects Multer versions from 1.4.4-lts.1 up to but not including 2.0.0.
What type of vulnerability is CVE-2025-47944?
CVE-2025-47944 is a Denial of Service (DoS) vulnerability triggered by malformed multi-part upload requests.
Can CVE-2025-47944 affect my application?
If your application uses Multer versions within the affected range, it is susceptible to CVE-2025-47944 and may experience service disruption.