High severity · published Oct 22, 2026
CVE-2026-113872
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
New
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while one file's asynchronous fileFilter is still pending, the pending callback later resumes a parsing stream that multer has already torn down, and the underlying parser emits an error on a stream that no longer has an error listener, which Node raises as an unhandled error event so the process exits. Any application using multer with an asynchronous fileFilter is affected regardless of storage engine, while uploads using a synchronous fileFilter are not affected. The issue is fixed in multer 2.5.0, and users should upgrade to 2.5.0 or later. As a workaround, use a synchronous fileFilter.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MU
multer · multer
2.0.0 before 2.5.0 · source: vendor
Affected product
MU
multer
multer
More from multer
7.5
CVE-2026-82333
multer vulnerable to Denial of Service via oversized array index in field names
7.5
CVE-2026-77078
multer vulnerable to Denial of Service via crafted multipart field names
7.5
CVE-2026-77037
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
7.5
CVE-2026-5038
multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads
7.5
CVE-2026-5079
multer vulnerable to Denial of Service via deeply nested field names