PT-2025-23654 · Multer · Multer

Dvtradeling · Published 2025-06-03 · Updated 2026-06-04 · CVE-2025-48997

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Multer versions 1.4.4-lts.1 through 2.0.0

Description A Denial of Service (DoS) issue is present, allowing an attacker to crash the process by sending an upload file request with an empty string field name, causing an unhandled exception.

Recommendations For Multer versions 1.4.4-lts.1 through 2.0.0, upgrade to version 2.0.1 to receive a patch.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

CVE-2025-48997

GHSA-G5HG-P3PH-G8QG

Affected Products

Multer

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/48xxx/CVE-2025-48997.json · Exploit
• https://osv.dev/vulnerability/GHSA-g5hg-p3ph-g8qg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48997 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2025-48997 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48997 · Security Note
• https://github.com/expressjs/multer · Note
• https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9 · Note
• https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg · Note
• https://github.com/expressjs/multer/pull/1256 · Note
• https://github.com/expressjs/multer/issues/1233 · Note
• https://t.me/cvetracker/25312 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930029242508517674 · Twitter Post
• https://twitter.com/CveFindCom/status/1929971548749758926 · Twitter Post
• https://twitter.com/kom_256/status/1929940385637323187 · Twitter Post
• https://twitter.com/CVEnew/status/1929974162442862825 · Twitter Post