Listen to this Post
How the CVE Works
The vulnerability in Multer (versions >= 1.4.4-lts.1, < 2.0.2) arises due to improper error handling when processing malformed HTTP requests. An attacker can craft a specially designed request that triggers an unhandled exception in the Multer middleware. This exception causes the Node.js process to crash, resulting in a Denial of Service (DoS) condition. The issue stems from insufficient input validation when parsing multipart form data, allowing malicious payloads to bypass checks and disrupt service availability.
DailyCVE Form
Platform: Node.js (Multer)
Version: 1.4.4-lts.1 to 2.0.1
Vulnerability: DoS via unhandled exception
Severity: Medium
Date: Jul 17, 2025
Prediction: Patch expected by Jul 24, 2025
What Undercode Say
Analytics:
npm audit --production curl -X POST -H "Content-Type: multipart/form-data" --data "malformed_data" http://target
How Exploit:
Craft malformed multipart request to crash server.
Protection from this CVE:
Upgrade to Multer 2.0.2.
Impact:
Service disruption due to process crash.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
