PT-2025-22068 · Multer · Multer

Ctcpip · Published 2025-05-19 · Updated 2026-06-04 · CVE-2025-47935

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Multer versions prior to 2.0.0

Description: The issue is related to improper stream handling in Multer, a node.js middleware for handling multipart/form-data. This leads to a resource exhaustion and memory leak issue when the HTTP request stream emits an error, as the internal busboy stream is not closed. As a result, unclosed streams accumulate over time, consuming memory and file descriptors, which can cause denial of service under sustained or repeated failure conditions. All users of Multer handling file uploads are potentially impacted.

Recommendations: For versions prior to 2.0.0, upgrade to 2.0.0 to receive a patch. As a temporary workaround, consider restricting the use of Multer for handling file uploads until the issue is resolved.

Exploit

Fix

DoS

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

CVE-2025-47935

GHSA-44FP-W29J-9VJ5

Affected Products

Multer

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47935.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-47935 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47935 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44fp-w29j-9vj5 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-47935 · Vendor Advisory
• https://github.com/expressjs/multer · Note
• https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665 · Note
• https://github.com/expressjs/multer/pull/1120 · Note
• https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5 · Note
• https://twitter.com/CVEnew/status/1924553784027726271 · Twitter Post
• https://twitter.com/kom_256/status/1924517495576175078 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1924618200030810515 · Twitter Post
• https://t.me/cvetracker/24276 · Telegram Post