View all vulnerabilities

CVE-2025-47935

Multer vulnerable to Denial of Service via memory leaks from unclosed streams

### ImpactMulter <2.0.0 is vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance.This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted.### PatchesUsers should upgrade to `2.0.0`### WorkaroundsNone### References- https://github.com/expressjs/multer/pull/1120- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665

Patch Available

Fix available through Seal Security. No upgrade required, protect your application instantly.

Fix without upgrading
Vulnerability Details
Score
7.5
Score Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Versions
multer < 2.0.0
Severity
High
Ecosystem
JavaScript
Publish Date
May 19, 2025
Modified Date
May 19, 2025