TI-2025-30328 Aliases CVE-2025-47935 GHSA-44fp-w29j-9vj5

Multer vulnerable to Denial of Service via memory leaks from unclosed streams

MEDIUM 40CWE-401Published 2025-05-19 · Updated 2025-05-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-401.

Summary

Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00795 56th percentileScored 2026-11-07

Fix Fixed multer (expressjs): 2.0.0multer (npm): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
expressjs	multer	before 2.0.0	2.0.0	Patch available	CNA
—	multer (npm)	before 2.0.0	2.0.0	Patch available	GHSA-44fp-w29j-9vj5

multer Vendorexpressjs Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA
multer (npm) Vendor— Affected before 2.0.0 Fixed in 2.0.0 Patch available GHSA-44fp-w29j-9vj5

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:expressjs:multer::::::::	—	—	expressjs

cpe:2.3:a:expressjs:multer:*:*:*:*:*:*:*:* Versions — — ·expressjs

Remediation

Fix · CNA multer (expressjs) Fixed in 2.0.0
Fix · GHSA-44fp-w29j-9vj5 multer (npm) Fixed in 2.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-47935
2026-10-03 Alias added: GHSA-44fp-w29j-9vj5

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-47935

Other 4

TI-2024-08602 Open redirect in expressjs express CVSS 3.1MEDIUM 4.7
TI-2026-03033 Multer vulnerable to Denial of Service via uncontrolled recursion CVSS 4.0HIGH 8.7
TI-2026-02853 Multer vulnerable to Denial of Service via incomplete cleanup CVSS 4.0HIGH 8.7
TI-2026-01995 Multer vulnerable to Denial of Service via resource exhaustion CVSS 4.0HIGH 8.7
TI-2025-31125 Multer vulnerable to Denial of Service via unhandled exception CVSS 4.0HIGH 8.7
TI-2025-30337 Multer vulnerable to Denial of Service from maliciously crafted requests CVSS 3.1HIGH 7.5

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences