High severity · published May 19, 2025
CVE-2025-47935
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
multer · expressjs
< 2.0.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47935
github.com
https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
github.com
https://github.com/expressjs/multer/pull/1120
github.com
https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5
More from multer
8.7
CVE-2025-48997
Multer vulnerable to Denial of Service via unhandled exception
7.5
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array index in field names
7.5
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart field names
7.5
CVE-2026-77037
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
7.5
CVE-2026-5038
multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
