Listen to this Post
How the CVE Works
Multer (<2.0.0) mishandles HTTP request streams during file uploads. When an error occurs, it fails to properly close the underlying `busboy` stream, leading to unclosed streams accumulating in memory. Node.js streams require explicit cleanup to release file descriptors and memory. Without proper closure, each failed request leaks resources, eventually exhausting system memory or file descriptors. Attackers can exploit this by repeatedly triggering upload failures, causing the server to crash or degrade performance due to resource starvation.
DailyCVE Form:
Platform: Node.js (Multer)
Version: <2.0.0
Vulnerability: Memory Leak
Severity: Critical
Date: May 19, 2025
What Undercode Say:
Analytics:
- Attack Vector: Remote
- Exploitability: Low complexity
- Impact: High (DoS)
- Affected Systems: Node.js servers using Multer for file uploads
Exploit Command:
while true; do curl -X POST -F "[email protected]" http://target/upload; done
Detection (Check for leaks):
const { heapUsed } = process.memoryUsage();
console.log(<code>Memory usage: ${heapUsed / 1024 / 1024} MB</code>);
Protection (Patch):
npm install [email protected] --save
Mitigation Code (Pre-2.0.0):
const multer = require('multer');
const upload = multer().single('file');
app.post('/upload', (req, res) => {
upload(req, res, (err) => {
if (err) {
req.destroy(); // Force close stream
res.status(500).send('Error');
}
});
});
Monitoring (Log leaks):
process.on('warning', (warning) => {
if (warning.name === 'MaxListenersExceededWarning') {
console.error('Stream leak detected:', warning);
}
});
Debugging (List open streams):
lsof -p $(pgrep node) | grep -E 'stream|busboy'
Alternative Workaround (Rate limiting):
const rateLimit = require('express-rate-limit');
app.use(rateLimit({ windowMs: 60000, max: 100 }));
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
